docs(mcp): document checkClaimEnvelope's accepted v1 gap

Round 7's review found an 8th bypass in the same "value hidden from the extractor" family as round 6, inside the fold logic round 7's own fix had just added (a blank line interrupting a folded continuation) — the second distinct gap found on the first alternate shape tried against that fix. Decision (Mathias, via the running sweep session): ship this PR's rounds 1-7 as v1 rather than continue incremental patches past the point of diminishing returns. Every bypass found across all 7 rounds requires the caller to already hold brain_edit write access and to deliberately construct a specific malformed-YAML shape with knowledge of this exact gap — narrow and low-likelihood next to another patch cycle. The real fix (one shared, tested, encoding-normalized frontmatter parser, replacing the three independent hand-rolled implementations this bug class keeps surfacing in) is tracked separately as hyperguild#138. Document the boundary directly on checkClaimEnvelope so the next person reading this function knows what's covered and what's a deliberate, recorded trade-off rather than an unnoticed gap. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
fix(mcp): fold YAML block-scalar continuations before validating the envelope
2026-09-23 12:25:30 +02:00 · 2026-09-23 10:51:09 +02:00 · 2026-09-23 10:44:54 +02:00 · 2026-09-23 10:40:00 +02:00 · 2026-09-23 10:32:46 +02:00 · 2026-09-23 10:27:30 +02:00
120 changed files with 725 additions and 9213 deletions
@@ -64,11 +64,7 @@ the routing pod; brain tools moved to the brain MCP.

 The brain HTTP REST API (`/query`, `/write`, `/ingest`, `/ingest-raw`,
 `/ingest-path`, `/backfill-refs`, `/pass-rate`) remains available on port 3300
-for shell scripts and non-MCP clients, **with the same bearer token as `/mcp`**
-(`BRAIN_MCP_TOKEN`; hyperguild#149). It is not served on the public host
-(infra#517): use the tailnet (`koala:8443`) or in-cluster
-`ingestion.supervisor.svc:3300`. `/ingest-path` and `brain_ingest` `path`
-accept only paths inside `brain/raw/`.
+for shell scripts and non-MCP clients.

 `brain_answer(query)` performs BM25 retrieval + LLM synthesis (berget.ai
 gemma4:31b → iguana fallback). `brain_classify(text)` infers doc type, title,
@@ -78,27 +78,6 @@ These rules apply to every task across every project, regardless of harness.
   when a human reviewer outside the project is required. Document the reason in
   PROJECT.md.

-   **Exception — a GitOps repo where a branch cannot be reconciled.** In a repo whose
-   deployment watches one branch (`mathias/infra`: Flux watches `main`), a branch is
-   invisible to the thing that applies it. A `risk/medium` change to `alerts.yaml` or
-   `litellm-config.yaml` can be linted on a branch but never *exercised* there, so a
-   PR would buy a review of a state that was never deployed.
-
-   There, `risk/medium`+ work stays on `main` and instead requires a **recorded
-   adversarial review pass before the push** — `skills:pr-gatekeeper` or equivalent,
-   reviewing the staged diff. **The reviewer's verdict goes in the issue, not a PR
-   thread.** No verdict recorded means the lane was not used, and saying "the gate was
-   green" is not the same claim.
-
-   Be honest about what this is: a recorded *independent* pass, not four-eyes in the
-   sense `assessor-loop` §4.1 means for a regulated organisation, because the reviewer
-   is an agent. It is more than the repo had and less than the model it mirrors; do not
-   describe it as the stronger property. (infra#470, decided 2026-09-29.)
-
-   This lane depends on the `risk/` label being right. A label that triggers a heavier
-   lane is load-bearing, not cosmetic — if work that belongs in it is unlabelled, the
-   lane silently does not apply.
-
 6. **Close the loop — every substantive task ends with the same ritual.** Shipping
   the code is not the end of the task; capturing it is. Run this unprompted:
   - **Tag + bump SemVer** on the change (annotated tag; minor for a feature or
@@ -127,43 +106,6 @@ These rules apply to every task across every project, regardless of harness.
   revisit Y". Those are exactly the items that need a locator. If it is worth
   saying in a summary, it is worth writing where it can be found again without you.

-7. **Finish what's closable — only involve me for a genuine call.** If a
-   tracker issue, PR, or checklist item is demonstrably resolved — the fix
-   landed, the state changed, you verified it live — close/merge/check it off
-   in the same turn. Don't leave it open "for the record" or park it waiting
-   on me to confirm something that already happened; that's bookkeeping, not
-   a decision. Reserve asking me (`AskUserQuestion`, a `DECISION NEEDED`
-   comment, or otherwise pausing) for when it's genuinely mine to call:
-   irreversible or prod/host-impacting actions, a real judgment call with no
-   clearly-better option, ambiguous intent, or anything secret-writes/
-   destructive-git already gate. Before claiming something is closable,
-   verify it live (re-check the issue, re-run the command) rather than
-   trusting your own earlier summary (brain: `filed-issue-not-same-as-fixed`).
-
-8. **Control code needs an adversary, not a checklist.** Code whose job is to
-   refuse, deny, gate or contain is not adequately verified by a green gate.
-   Rule 5 makes CI the quality gate and that holds for ordinary work — but a
-   passing suite only asserts what its author already thought of, and for a
-   control the author is precisely the person whose imagination just failed.
-   Measured on `dispatch#75`: five review rounds, five real escapes verified by
-   execution, and **CI was green on every one of them** while `git rm
-   ././.dispatch-allow` deleted the file the control existed to protect. So
-   route this work through a review with authority to block, instructed to
-   verify by execution rather than by reading the implementation. Expect to be
-   blocked more than once; that is the control working, not the reviewer being
-   difficult. (brain: `a-green-gate-is-not-evidence-for-control-code`; the
-   practices live in the `pr-gatekeeper` agent.)
-
-9. **A test's name must not claim more than its assertions prove.** Name a test
-   after the mechanism it observes, not the goal it serves.
-   `DoesNotInheritEnv` is honest; `IsContained` is a claim the test cannot
-   support. This is not pedantry about naming — when name and assertion
-   diverge, the name wins in the reader's head and the gap becomes invisible,
-   which is what lets the defect survive review. Found three times in one PR,
-   twice in tests written to fix the previous instance of it; each passed while
-   the thing it was named for was exploitable. If you cannot name the mechanism,
-   you do not yet know what the test observes.
-
 ## CAD sprint patterns

 Two CAD sprint archetypes (defs: brain `wiki/homelab/decisions/continuous-agentic-development-cad-concept-2026-06-16`):
@@ -304,16 +246,10 @@ entries that age well are about *why*, *how to avoid*, and *what to do when*.
 |---------|-------|-------|
 | **Claude Code, Claude Desktop** | `brain_query` (BM25), `brain_answer` (LLM-synth + sources) MCP tools | `brain_write` MCP tool |
 | **Crush, Pi, Antigravity, other MCP-capable** | same MCP server: `ingestion-brain` (via the `mcp__*_brain__*` namespace once authenticated) | same |
-| **Anything HTTP-only (curl, scripts)** | Tailnet only: `POST https://koala.tail30472e.ts.net:8443/query` with `{"query":"..."}`, sending `BRAIN_MCP_TOKEN` (not yet enforced on REST, hyperguild#149). The public `brain-mcp.d-ma.be` serves `/mcp` only (infra#517). | `POST .../write` with `{"content":"...","wing":"...","hall":"..."}` |
+| **Anything HTTP-only (curl, scripts)** | `POST https://brain-mcp.d-ma.be/query` with `{"query":"..."}` (auth via `BRAIN_MCP_TOKEN`) | `POST .../write` with `{"content":"...","filename":"..."}` |
 | **Browser / human inspection** | `https://git.d-ma.be/mathias/hyperguild` → `knowledge/` and `wiki/` markdown files |

- **Scoping — the brain holds no confidential client content.** Nothing on the read path
-  filters by client: every token holder can read every wing, and `wing` on `brain_query`
-  is an optional argument, not an access control. Client confidentiality is enforced only
-  at write time (`capture`'s I1 gate refuses internal/confidential). So never `brain_write`
-  client material; generalise it first or keep it in the client's own repo. (hyperguild#144,
-  decided 2026-10-01. This line previously claimed client projects were filtered; they
-  were not.)
+- **Scoping**: defaults to `public` collection; client projects filter to `{client}` + `public`.
 - **Routing**: brain_answer's LLM uses berget.ai as primary, iguana ollama as
  fallback. Both are configurable in the `supervisor/ingestion-deployment.yaml`
  on the koala k3s cluster; don't hardcode local-only model names into the
@@ -383,20 +319,8 @@ Workflow:
   and missing-untracked adapters). A drift fails the check with a
   message telling you to stage the regenerated files.

-Behavior rules in this file and per-project rules in `PROJECT.md` apply on every
-host and every harness.
-
-**Where a project rule contradicts a rule here, the project rule governs — and it
-must state its reason.** Both halves matter: the project file wins because it knows
-something this file cannot (infra's Flux constraint is real and not visible from
-here), and it must say why because a bare override is indistinguishable from drift.
-
-This replaces the previous wording, which said rules here and in `PROJECT.md` both
-apply *"unconditionally"*. That was not a tiebreak but a contradiction, and it went
-unnoticed until rule 5 and infra's "never create feature branches" had to be obeyed
-at the same time (infra#470). A standard can hold two individually sensible clauses
-that are jointly unsatisfiable, and survive for as long as everyone reads it
-charitably — the same failure the Inception Sprint Oath's G6 had.
+Behavior rules in this file and per-project rules in `PROJECT.md` apply
+unconditionally on every host, every harness.

 ## Engineering Skills

@@ -493,11 +417,7 @@ the routing pod; brain tools moved to the brain MCP.

 The brain HTTP REST API (`/query`, `/write`, `/ingest`, `/ingest-raw`,
 `/ingest-path`, `/backfill-refs`, `/pass-rate`) remains available on port 3300
-for shell scripts and non-MCP clients, **with the same bearer token as `/mcp`**
-(`BRAIN_MCP_TOKEN`; hyperguild#149). It is not served on the public host
-(infra#517): use the tailnet (`koala:8443`) or in-cluster
-`ingestion.supervisor.svc:3300`. `/ingest-path` and `brain_ingest` `path`
-accept only paths inside `brain/raw/`.
+for shell scripts and non-MCP clients.

 `brain_answer(query)` performs BM25 retrieval + LLM synthesis (berget.ai
 gemma4:31b → iguana fallback). `brain_classify(text)` infers doc type, title,
@@ -73,27 +73,6 @@ These rules apply to every task across every project, regardless of harness.
   when a human reviewer outside the project is required. Document the reason in
   PROJECT.md.

-   **Exception — a GitOps repo where a branch cannot be reconciled.** In a repo whose
-   deployment watches one branch (`mathias/infra`: Flux watches `main`), a branch is
-   invisible to the thing that applies it. A `risk/medium` change to `alerts.yaml` or
-   `litellm-config.yaml` can be linted on a branch but never *exercised* there, so a
-   PR would buy a review of a state that was never deployed.
-
-   There, `risk/medium`+ work stays on `main` and instead requires a **recorded
-   adversarial review pass before the push** — `skills:pr-gatekeeper` or equivalent,
-   reviewing the staged diff. **The reviewer's verdict goes in the issue, not a PR
-   thread.** No verdict recorded means the lane was not used, and saying "the gate was
-   green" is not the same claim.
-
-   Be honest about what this is: a recorded *independent* pass, not four-eyes in the
-   sense `assessor-loop` §4.1 means for a regulated organisation, because the reviewer
-   is an agent. It is more than the repo had and less than the model it mirrors; do not
-   describe it as the stronger property. (infra#470, decided 2026-09-29.)
-
-   This lane depends on the `risk/` label being right. A label that triggers a heavier
-   lane is load-bearing, not cosmetic — if work that belongs in it is unlabelled, the
-   lane silently does not apply.
-
 6. **Close the loop — every substantive task ends with the same ritual.** Shipping
   the code is not the end of the task; capturing it is. Run this unprompted:
   - **Tag + bump SemVer** on the change (annotated tag; minor for a feature or
@@ -122,43 +101,6 @@ These rules apply to every task across every project, regardless of harness.
   revisit Y". Those are exactly the items that need a locator. If it is worth
   saying in a summary, it is worth writing where it can be found again without you.

-7. **Finish what's closable — only involve me for a genuine call.** If a
-   tracker issue, PR, or checklist item is demonstrably resolved — the fix
-   landed, the state changed, you verified it live — close/merge/check it off
-   in the same turn. Don't leave it open "for the record" or park it waiting
-   on me to confirm something that already happened; that's bookkeeping, not
-   a decision. Reserve asking me (`AskUserQuestion`, a `DECISION NEEDED`
-   comment, or otherwise pausing) for when it's genuinely mine to call:
-   irreversible or prod/host-impacting actions, a real judgment call with no
-   clearly-better option, ambiguous intent, or anything secret-writes/
-   destructive-git already gate. Before claiming something is closable,
-   verify it live (re-check the issue, re-run the command) rather than
-   trusting your own earlier summary (brain: `filed-issue-not-same-as-fixed`).
-
-8. **Control code needs an adversary, not a checklist.** Code whose job is to
-   refuse, deny, gate or contain is not adequately verified by a green gate.
-   Rule 5 makes CI the quality gate and that holds for ordinary work — but a
-   passing suite only asserts what its author already thought of, and for a
-   control the author is precisely the person whose imagination just failed.
-   Measured on `dispatch#75`: five review rounds, five real escapes verified by
-   execution, and **CI was green on every one of them** while `git rm
-   ././.dispatch-allow` deleted the file the control existed to protect. So
-   route this work through a review with authority to block, instructed to
-   verify by execution rather than by reading the implementation. Expect to be
-   blocked more than once; that is the control working, not the reviewer being
-   difficult. (brain: `a-green-gate-is-not-evidence-for-control-code`; the
-   practices live in the `pr-gatekeeper` agent.)
-
-9. **A test's name must not claim more than its assertions prove.** Name a test
-   after the mechanism it observes, not the goal it serves.
-   `DoesNotInheritEnv` is honest; `IsContained` is a claim the test cannot
-   support. This is not pedantry about naming — when name and assertion
-   diverge, the name wins in the reader's head and the gap becomes invisible,
-   which is what lets the defect survive review. Found three times in one PR,
-   twice in tests written to fix the previous instance of it; each passed while
-   the thing it was named for was exploitable. If you cannot name the mechanism,
-   you do not yet know what the test observes.
-
 ## CAD sprint patterns

 Two CAD sprint archetypes (defs: brain `wiki/homelab/decisions/continuous-agentic-development-cad-concept-2026-06-16`):
@@ -299,16 +241,10 @@ entries that age well are about *why*, *how to avoid*, and *what to do when*.
 |---------|-------|-------|
 | **Claude Code, Claude Desktop** | `brain_query` (BM25), `brain_answer` (LLM-synth + sources) MCP tools | `brain_write` MCP tool |
 | **Crush, Pi, Antigravity, other MCP-capable** | same MCP server: `ingestion-brain` (via the `mcp__*_brain__*` namespace once authenticated) | same |
-| **Anything HTTP-only (curl, scripts)** | Tailnet only: `POST https://koala.tail30472e.ts.net:8443/query` with `{"query":"..."}`, sending `BRAIN_MCP_TOKEN` (not yet enforced on REST, hyperguild#149). The public `brain-mcp.d-ma.be` serves `/mcp` only (infra#517). | `POST .../write` with `{"content":"...","wing":"...","hall":"..."}` |
+| **Anything HTTP-only (curl, scripts)** | `POST https://brain-mcp.d-ma.be/query` with `{"query":"..."}` (auth via `BRAIN_MCP_TOKEN`) | `POST .../write` with `{"content":"...","filename":"..."}` |
 | **Browser / human inspection** | `https://git.d-ma.be/mathias/hyperguild` → `knowledge/` and `wiki/` markdown files |

- **Scoping — the brain holds no confidential client content.** Nothing on the read path
-  filters by client: every token holder can read every wing, and `wing` on `brain_query`
-  is an optional argument, not an access control. Client confidentiality is enforced only
-  at write time (`capture`'s I1 gate refuses internal/confidential). So never `brain_write`
-  client material; generalise it first or keep it in the client's own repo. (hyperguild#144,
-  decided 2026-10-01. This line previously claimed client projects were filtered; they
-  were not.)
+- **Scoping**: defaults to `public` collection; client projects filter to `{client}` + `public`.
 - **Routing**: brain_answer's LLM uses berget.ai as primary, iguana ollama as
  fallback. Both are configurable in the `supervisor/ingestion-deployment.yaml`
  on the koala k3s cluster; don't hardcode local-only model names into the
@@ -378,20 +314,8 @@ Workflow:
   and missing-untracked adapters). A drift fails the check with a
   message telling you to stage the regenerated files.

-Behavior rules in this file and per-project rules in `PROJECT.md` apply on every
-host and every harness.
-
-**Where a project rule contradicts a rule here, the project rule governs — and it
-must state its reason.** Both halves matter: the project file wins because it knows
-something this file cannot (infra's Flux constraint is real and not visible from
-here), and it must say why because a bare override is indistinguishable from drift.
-
-This replaces the previous wording, which said rules here and in `PROJECT.md` both
-apply *"unconditionally"*. That was not a tiebreak but a contradiction, and it went
-unnoticed until rule 5 and infra's "never create feature branches" had to be obeyed
-at the same time (infra#470). A standard can hold two individually sensible clauses
-that are jointly unsatisfiable, and survive for as long as everyone reads it
-charitably — the same failure the Inception Sprint Oath's G6 had.
+Behavior rules in this file and per-project rules in `PROJECT.md` apply
+unconditionally on every host, every harness.

 ## Engineering Skills

@@ -488,11 +412,7 @@ the routing pod; brain tools moved to the brain MCP.

 The brain HTTP REST API (`/query`, `/write`, `/ingest`, `/ingest-raw`,
 `/ingest-path`, `/backfill-refs`, `/pass-rate`) remains available on port 3300
-for shell scripts and non-MCP clients, **with the same bearer token as `/mcp`**
-(`BRAIN_MCP_TOKEN`; hyperguild#149). It is not served on the public host
-(infra#517): use the tailnet (`koala:8443`) or in-cluster
-`ingestion.supervisor.svc:3300`. `/ingest-path` and `brain_ingest` `path`
-accept only paths inside `brain/raw/`.
+for shell scripts and non-MCP clients.

 `brain_answer(query)` performs BM25 retrieval + LLM synthesis (berget.ai
 gemma4:31b → iguana fallback). `brain_classify(text)` infers doc type, title,
@@ -64,11 +64,7 @@ the routing pod; brain tools moved to the brain MCP.

 The brain HTTP REST API (`/query`, `/write`, `/ingest`, `/ingest-raw`,
 `/ingest-path`, `/backfill-refs`, `/pass-rate`) remains available on port 3300
-for shell scripts and non-MCP clients, **with the same bearer token as `/mcp`**
-(`BRAIN_MCP_TOKEN`; hyperguild#149). It is not served on the public host
-(infra#517): use the tailnet (`koala:8443`) or in-cluster
-`ingestion.supervisor.svc:3300`. `/ingest-path` and `brain_ingest` `path`
-accept only paths inside `brain/raw/`.
+for shell scripts and non-MCP clients.

 `brain_answer(query)` performs BM25 retrieval + LLM synthesis (berget.ai
 gemma4:31b → iguana fallback). `brain_classify(text)` infers doc type, title,
@@ -20,7 +20,6 @@ const defaultBrainURL = "http://koala:30330"
 // shell-friendly client; MCP framing is unnecessary.
 type brainClient struct {
 	baseURL string
-	token   string // BRAIN_MCP_TOKEN; the REST API requires it since hyperguild#149
 	http    *http.Client
 }

@@ -31,7 +30,6 @@ func newBrainClient() *brainClient {
 	}
 	return &brainClient{
 		baseURL: u,
-		token:   os.Getenv("BRAIN_MCP_TOKEN"),
 		http:    &http.Client{Timeout: 5 * time.Second},
 	}
 }
@@ -64,7 +62,8 @@ func (c *brainClient) Query(ctx context.Context, topic string, limit int) (*Quer
 		return nil, fmt.Errorf("build request: %w", err)
 	}
 	req.Header.Set("Content-Type", "application/json")
-	resp, err := c.do(req)
+
+	resp, err := c.http.Do(req)
 	if err != nil {
 		return nil, fmt.Errorf("brain POST /query: %w", err)
 	}
@@ -106,7 +105,8 @@ func (c *brainClient) Write(ctx context.Context, wing, hall, filename string, co
 		return nil, fmt.Errorf("build request: %w", err)
 	}
 	req.Header.Set("Content-Type", "application/json")
-	resp, err := c.do(req)
+
+	resp, err := c.http.Do(req)
 	if err != nil {
 		return nil, fmt.Errorf("brain POST /write: %w", err)
 	}
@@ -143,7 +143,7 @@ func (c *brainClient) PassRate(ctx context.Context, skill, window string) (*Pass
 	if err != nil {
 		return nil, fmt.Errorf("build request: %w", err)
 	}
-	resp, err := c.do(req)
+	resp, err := c.http.Do(req)
 	if err != nil {
 		return nil, fmt.Errorf("brain GET /pass-rate: %w", err)
 	}
@@ -158,13 +158,3 @@ func (c *brainClient) PassRate(ctx context.Context, skill, window string) (*Pass
 	}
 	return &out, nil
 }
-
-// do sends every brain request, adding the bearer token when one is
-// configured. All methods go through here so none can forget it (PassRate
-// did, PR #152 review).
-func (c *brainClient) do(req *http.Request) (*http.Response, error) {
-	if c.token != "" {
-		req.Header.Set("Authorization", "Bearer "+c.token)
-	}
-	return c.http.Do(req)
-}
@@ -1,57 +0,0 @@
-package main
-
-import (
-	"context"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// hyperguild#149: the ingestion REST API now requires a bearer token; the CLI
-// sends BRAIN_MCP_TOKEN, or it gets 401 on every brain call.
-func TestBrainClientSendsBrainMCPTokenOnQueryWriteAndPassRate(t *testing.T) {
-	var got []string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		got = append(got, r.URL.Path+" "+r.Header.Get("Authorization"))
-		switch r.URL.Path {
-		case "/write":
-			_, _ = w.Write([]byte(`{"path":"wiki/x/facts/y.md"}`))
-			return
-		case "/pass-rate":
-			_, _ = w.Write([]byte(`{}`))
-			return
-		}
-		_, _ = w.Write([]byte(`{"results":[]}`))
-	}))
-	defer srv.Close()
-	t.Setenv("BRAIN_URL", srv.URL)
-	t.Setenv("BRAIN_MCP_TOKEN", "cli-test-token")
-
-	c := newBrainClient()
-	_, err := c.Query(context.Background(), "x", 1)
-	require.NoError(t, err)
-	_, err = c.Write(context.Background(), "x", "facts", "y", strings.NewReader("# y"))
-	require.NoError(t, err)
-	// PR #152 review: PassRate sent no token and would 401 in production.
-	_, _ = c.PassRate(context.Background(), "tdd", "7d")
-	assert.Equal(t, []string{"/query Bearer cli-test-token", "/write Bearer cli-test-token",
-		"/pass-rate Bearer cli-test-token"}, got)
-}
-
-func TestBrainClientSendsNoAuthorizationWhenTokenUnset(t *testing.T) {
-	var auth string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		auth = r.Header.Get("Authorization")
-		_, _ = w.Write([]byte(`{"results":[]}`))
-	}))
-	defer srv.Close()
-	t.Setenv("BRAIN_URL", srv.URL)
-	t.Setenv("BRAIN_MCP_TOKEN", "")
-	_, err := newBrainClient().Query(context.Background(), "x", 1)
-	require.NoError(t, err)
-	assert.Empty(t, auth)
-}
@@ -24,7 +24,7 @@ Only a `tools/call` to the routing pod records a pass/fail.
 |---------|-----|------|
 | Routing MCP (local, Tailscale) | `http://koala:30310/mcp` | Bearer `ROUTING_MCP_TOKEN` |
 | Routing MCP (remote) | `https://routing-mcp.d-ma.be/mcp` | OAuth via `auth.d-ma.be` (audience `claude-ai`) |
-| Pass-rate readout | `http://koala:30330/pass-rate?skill=<name>` | Bearer `BRAIN_MCP_TOKEN` (since hyperguild#149) |
+| Pass-rate readout | `http://koala:30330/pass-rate?skill=<name>` | none (read-only) |

 Tools advertised: **`review`**, **`debug`** (the two the #35 gate measures),
 plus `session_log`, `retrospective`, `trainer`.
@@ -1,26 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-	"log/slog"
-
-	chassisauth "git.d-ma.be/mathias/mcp-chassis/auth"
-)
-
-// buildJWTValidator builds the JWT validator for issuer (nil when issuer is
-// empty: JWT auth disabled). Since mcp-chassis v0.7 construction no longer
-// fails when OIDC discovery does (mcp-chassis#4): the issuer resolves lazily,
-// and until it does a JWT is answered 503-and-retry, not 401. That replaces
-// #83's boot-time retry loop (hyperguild#155). An issuer still unresolved at
-// boot is logged, so a misconfigured issuer is visible rather than silent.
-func buildJWTValidator(ctx context.Context, logger *slog.Logger, issuer, audience string) (*chassisauth.JWTValidator, error) {
-	v, err := chassisauth.NewJWTValidator(ctx, issuer, audience)
-	if err != nil {
-		return nil, fmt.Errorf("build jwt validator: %w", err)
-	}
-	if ok, rerr := v.Ready(ctx); !ok {
-		logger.Warn("jwt issuer not resolved at boot; JWTs answer 503 until it is", "issuer", issuer, "err", rerr)
-	}
-	return v, nil
-}
@@ -1,111 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"context"
-	"io"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"sync/atomic"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/metrics"
-)
-
-// fakeIssuer answers OIDC discovery with 502 for the first fail requests, as
-// ingress does while dex is not yet serving on a cold boot (#83), then with a
-// real discovery document and an empty JWKS.
-func fakeIssuer(t *testing.T, fail int32) (*httptest.Server, *atomic.Int32) {
-	t.Helper()
-	var discoveries atomic.Int32
-	mux := http.NewServeMux()
-	var srv *httptest.Server
-	mux.HandleFunc("/.well-known/openid-configuration", func(w http.ResponseWriter, _ *http.Request) {
-		if discoveries.Add(1) <= fail {
-			w.WriteHeader(http.StatusBadGateway)
-			return
-		}
-		w.Header().Set("Content-Type", "application/json")
-		_, _ = io.WriteString(w, `{"issuer":"`+srv.URL+`","jwks_uri":"`+srv.URL+`/keys"}`)
-	})
-	mux.HandleFunc("/keys", func(w http.ResponseWriter, _ *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-		_, _ = io.WriteString(w, `{"keys":[]}`)
-	})
-	srv = httptest.NewServer(mux)
-	t.Cleanup(srv.Close)
-	return srv, &discoveries
-}
-
-// #83 retried discovery at boot because chassis v0.2.0 failed construction on
-// a 502. Since chassis v0.7 (mcp-chassis#4) the validator is built anyway and
-// resolves the issuer lazily, so boot no longer waits or exits on it
-// (hyperguild#155). An unresolved issuer is logged at boot.
-func TestBuildJWTValidatorReturnsAValidatorWhileDiscovery502s(t *testing.T) {
-	srv, _ := fakeIssuer(t, 1000)
-	var buf bytes.Buffer
-	v, err := buildJWTValidator(context.Background(), slog.New(slog.NewTextHandler(&buf, nil)), srv.URL, "brain")
-	require.NoError(t, err)
-	assert.NotNil(t, v)
-	assert.Contains(t, buf.String(), "jwt issuer not resolved at boot")
-}
-
-func TestBuildJWTValidatorLogsNothingAgainstAHealthyIssuer(t *testing.T) {
-	srv, _ := fakeIssuer(t, 0)
-	var buf bytes.Buffer
-	v, err := buildJWTValidator(context.Background(), slog.New(slog.NewTextHandler(&buf, nil)), srv.URL, "brain")
-	require.NoError(t, err)
-	assert.NotNil(t, v)
-	assert.NotContains(t, buf.String(), "not resolved")
-}
-
-func TestBuildJWTValidatorIsNilWithoutAnIssuer(t *testing.T) {
-	v, err := buildJWTValidator(context.Background(), slog.New(slog.DiscardHandler), "", "brain")
-	require.NoError(t, err)
-	assert.Nil(t, v)
-}
-
-// With the issuer unresolved, a JWT on a REST route answers 503 (retry), not
-// 401: the token may be fine, the server just cannot check it yet.
-func TestBuildMuxAnswers503ToAJWTWhileTheIssuerIsUnresolved(t *testing.T) {
-	srv, _ := fakeIssuer(t, 1000)
-	v, err := buildJWTValidator(context.Background(), slog.New(slog.DiscardHandler), srv.URL, "brain")
-	require.NoError(t, err)
-	mux, err := buildMux(restAuth{token: routesTok, validator: v, realm: "brain"}, testHandler(t),
-		okHandler("mcp"), metrics.New(), nil)
-	require.NoError(t, err)
-	code, _ := do(t, mux, "GET", "/pending", "Bearer aaa.bbb.ccc")
-	assert.Equal(t, http.StatusServiceUnavailable, code)
-}
-
-// PR #183 review: /mcp shares REST's bearer, but only the static token was
-// asserted on it. With the issuer unresolved, a JWT on /mcp answers 503 too,
-// so /mcp's middleware was built with the JWT validator.
-func TestBuildMuxAnswers503ToAJWTOnMCPWhileTheIssuerIsUnresolved(t *testing.T) {
-	srv, _ := fakeIssuer(t, 1000)
-	v, err := buildJWTValidator(context.Background(), slog.New(slog.DiscardHandler), srv.URL, "brain")
-	require.NoError(t, err)
-	mux, err := buildMux(restAuth{token: routesTok, validator: v, realm: "brain"}, testHandler(t),
-		okHandler("mcp"), metrics.New(), nil)
-	require.NoError(t, err)
-	code, _ := do(t, mux, "POST", "/mcp", "Bearer aaa.bbb.ccc")
-	assert.Equal(t, http.StatusServiceUnavailable, code)
-}
-
-// PR #183 review: a 401 on /mcp names the protected-resource metadata in
-// WWW-Authenticate (what the claude.ai OAuth connector discovers from), so
-// /mcp's middleware was built with resourceMetadataURL.
-func TestBuildMuxMCP401CarriesResourceMetadataInWWWAuthenticate(t *testing.T) {
-	const rm = "https://brain.example/.well-known/oauth-protected-resource"
-	mux, err := buildMux(restAuth{token: routesTok, realm: "brain", resourceMetadataURL: rm}, testHandler(t),
-		okHandler("mcp"), metrics.New(), nil)
-	require.NoError(t, err)
-	rec := httptest.NewRecorder()
-	mux.ServeHTTP(rec, httptest.NewRequest(http.MethodPost, "/mcp", nil))
-	require.Equal(t, http.StatusUnauthorized, rec.Code)
-	assert.Contains(t, rec.Header().Get("WWW-Authenticate"), `resource_metadata="`+rm+`"`)
-}
@@ -32,7 +32,7 @@ import (
 	"github.com/mathiasbq/hyperguild/ingestion/internal/pipeline"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/reranker"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/search"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/symlinkguard"
+	"github.com/mathiasbq/hyperguild/ingestion/internal/startupretry"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/vectorstore"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/watcher"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/webhook"
@@ -147,44 +147,9 @@ func envInt(key string, fallback int) int {
 // buildNotifier returns the ntfy notifier, or a nil interface when
 // BRAIN_NTFY_URL is unset. A nil *interface* (not a typed-nil) is required so
 // DegradingSink/Reconcile and the governance observer skip it cleanly.
-// alertingWarnings names every alert that will not fire under the current
-// configuration (#107).
-//
-// buildNotifier returns a nil interface when BRAIN_NTFY_URL is unset, and every
-// consumer skips a nil notifier silently — right for an unconfigured homelab,
-// wrong for an alert whose entire value is that someone finds out. The cost of
-// the silence is that "configured and working" and "never configured" are
-// byte-identical in behaviour: no error, no warning, only a message that never
-// arrives, which nobody notices because nobody is waiting for an alert they
-// have never seen. Two alerts were dark in production for exactly that reason
-// (#100), found by firing a real event rather than by reading anything.
-//
-// WARN rather than fatal, deliberately. The brain sibling rule
-// (`empty-credential-must-refuse-to-start-not-switch-modes`) says an empty
-// credential must be a startup error, never a silent mode switch — but that is
-// about a control being removed. Here observability is degraded, not a gate
-// bypassed, and refusing to boot would break the unconfigured-homelab case the
-// nil notifier exists to support. What the rule does demand, and what this
-// provides, is that the mode switch stops being silent.
-//
-// Pure and env-injected so the message is testable without a running server:
-// the reason this gap survived is that nothing about it was observable.
-func alertingWarnings(getenv func(string) string) []string {
-	var out []string
-	if getenv("BRAIN_NTFY_URL") == "" {
-		out = append(out, "alerting DISABLED: BRAIN_NTFY_URL unset — "+
-			"brain_edit_root governance rewrites, capture audit degradation and the "+
-			"brain symlink tripwire (hyperguild#157) will not notify")
-	}
-	return out
-}
-
-// buildNotifier returns the ntfy notifier for one alert source, titled so
-// the source is recognisable (hyperguild#163), or nil when ntfy is not
-// configured.
-func buildNotifier(getenv func(string) string, title string) audit.Notifier {
-	if n := audit.NewNtfyNotifier(getenv("BRAIN_NTFY_URL"), getenv("BRAIN_NTFY_TOKEN")); n != nil {
-		return n.WithTitle(title)
+func buildNotifier() audit.Notifier {
+	if n := audit.NewNtfyNotifier(os.Getenv("BRAIN_NTFY_URL"), os.Getenv("BRAIN_NTFY_TOKEN")); n != nil {
+		return n
 	}
 	return nil
 }
@@ -206,7 +171,7 @@ func buildAuditSink(ctx context.Context, brainDir string, logger *slog.Logger) c
 		logger.Error("capture audit buffer init", "err", err)
 		os.Exit(1)
 	}
-	notifier := buildNotifier(os.Getenv, "brain-capture audit degraded")
+	notifier := buildNotifier()
 	reconcileInterval := time.Duration(envInt("BRAIN_AUDIT_RECONCILE_INTERVAL", 60)) * time.Second
 	audit.StartReconcile(ctx, central, buffer, notifier, reconcileInterval)
 	logger.Info("capture audit: loki+buffer sink", "loki", lokiURL, "reconcile_s", int(reconcileInterval.Seconds()))
@@ -238,15 +203,7 @@ func systemHostname() string {
 func main() {
 	logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))

-	for _, w := range alertingWarnings(os.Getenv) {
-		logger.Warn(w)
-	}
-
 	brainDir := envOr("INGEST_BRAIN_DIR", "../brain")
-	if err := startupSymlinkCheck(brainDir); err != nil {
-		logger.Error("brain symlink tripwire", "err", err)
-		os.Exit(1)
-	}
 	port := envOr("INGEST_PORT", "3300")

 	llmURL := envOr("INGEST_LLM_URL", "http://iguana:4000/v1")
@@ -368,18 +325,28 @@ func main() {
 	}

 	ctx := context.Background()
-	// hyperguild#157: report a symlink that appears in the brain while running.
-	go symlinkguard.Watch(ctx, brainDir, symlinkScanInterval(os.Getenv), buildNotifier(os.Getenv, "brain symlink tripwire"))

-	// Never fatal on an unreachable issuer (#83): on a cold cluster boot this
-	// pod can beat dex to serving and get a 502 from ingress, and exiting meant
-	// CrashLoopBackOff redoing the backfill. Since mcp-chassis v0.7 the
-	// validator resolves the issuer lazily and answers JWTs 503-and-retry until
-	// it does (hyperguild#155), so no boot retry is needed. A misconfigured
-	// issuer no longer exits the process: it is logged at boot and every JWT
-	// gets 503; the static bearer keeps working.
-	jwtValidator, err := buildJWTValidator(ctx, logger,
-		os.Getenv("DEX_ISSUER_URL"), os.Getenv("MCP_AUDIENCE"))
+	// Built before the watcher, the graph backfill and session ingestion, and
+	// retried rather than fatal (#83). Two separate reasons:
+	//
+	//   - On a cold cluster boot this pod can beat dex to serving and gets a
+	//     502 from ingress. Nothing is misconfigured; it simply started first.
+	//     Exiting there meant CrashLoopBackOff redoing the backfill on every
+	//     attempt, with exponential backoff stretching the brain outage.
+	//   - Constructing it first means a genuine config error (wrong issuer,
+	//     bad audience) fails in seconds instead of after all that work.
+	//
+	// The budget stays bounded: retrying forever would turn a misconfiguration
+	// into a process that looks alive and never serves.
+	jwtValidator, err := startupretry.Do(ctx,
+		startupretry.Policy{Attempts: 8, Base: time.Second, Max: 30 * time.Second},
+		func(ctx context.Context) (*chassisauth.JWTValidator, error) {
+			v, err := chassisauth.NewJWTValidator(ctx, os.Getenv("DEX_ISSUER_URL"), os.Getenv("MCP_AUDIENCE"))
+			if err != nil {
+				logger.Warn("oidc discovery not ready, retrying", "err", err)
+			}
+			return v, err
+		})
 	if err != nil {
 		logger.Error("build jwt validator", "err", err)
 		os.Exit(1)
@@ -501,10 +468,20 @@ func main() {
 		logger.Info("embed sync started", "interval_s", embedSyncInterval)
 	}

-	// Public routes only; buildMux mounts the authenticated REST API (#149).
-	public := map[string]http.Handler{}
+	mux := http.NewServeMux()
+	mux.HandleFunc("POST /query", h.Query)
+	mux.HandleFunc("POST /write", h.Write)
+	mux.HandleFunc("POST /index", h.Index)
+	mux.HandleFunc("POST /ingest", h.Ingest)
+	mux.HandleFunc("POST /ingest-path", h.IngestPath)
+	mux.HandleFunc("POST /ingest-raw", h.IngestRaw)
+	mux.HandleFunc("POST /backfill-refs", h.BackfillRefs)
+	mux.HandleFunc("GET /pending", h.Pending)
+	mux.HandleFunc("POST /promote", h.Promote)
+	mux.HandleFunc("POST /backfill-embeddings", h.BackfillEmbeddings)
+	mux.HandleFunc("GET /pass-rate", h.PassRate)
 	if webhookHandler != nil {
-		public["POST /webhooks/brain-sync"] = webhookHandler
+		mux.Handle("POST /webhooks/brain-sync", webhookHandler)
 	}
 	// Resource-metadata URL is only emitted on 401 when Dex OAuth is
 	// configured. Static-Bearer-only deployments leave this empty so
@@ -512,13 +489,15 @@ func main() {
 	var resourceMetadataURL string
 	if dexURL := os.Getenv("DEX_ISSUER_URL"); dexURL != "" {
 		resourceURL := os.Getenv("MCP_RESOURCE_URL")
-		public["GET /.well-known/oauth-protected-resource"] = http.HandlerFunc(
+		mux.HandleFunc("GET /.well-known/oauth-protected-resource",
 			chassisauth.ProtectedResourceHandler(resourceURL, dexURL))
 		if resourceURL != "" {
 			resourceMetadataURL = strings.TrimRight(resourceURL, "/") + "/.well-known/oauth-protected-resource"
 		}
 	}

+	mux.Handle("/mcp", chassisauth.BearerMiddleware(mcpToken, jwtValidator, "brain", resourceMetadataURL, mcpSrv))
+
 	// POST /capture (#53/#54): the uniform capture REST door. Needs a ticket
 	// tracker to file action items, so it only mounts when Gitea is
 	// configured. It reuses the MCP server's graph-wired brain store (one
@@ -539,17 +518,17 @@ func main() {
 		sovereign := splitList(os.Getenv("BRAIN_CAPTURE_SOVEREIGN_PRINCIPALS"))
 		resolver := capturehttp.NewOriginResolver(sovereign)
 		captureH := capturehttp.New(captureSvc, jwtValidator, mcpToken, "local-cli", resolver)
-		public["POST /capture"] = captureH
+		mux.Handle("POST /capture", captureH)
 		// Same use-case behind the MCP `capture` tool (#55 relay) so MCP-native
 		// harnesses (claude.ai, Crush, Pi, LLM Council) reach capture through
-		// the existing /mcp OAuth connector. buildMux wraps this same mcpSrv;
+		// the existing /mcp OAuth connector. mcpSrv is already wrapped above;
 		// WithCapture mutates the same instance, so the tool appears live.
 		mcpSrv.WithCapture(captureSvc, jwtValidator, mcpToken, "local-cli", resolver)
 		// hyperguild#97: a governance-file rewrite gets the same trail a
 		// capture already gets, plus an out-of-band alert. Wired here because
 		// brain_edit_root needs the capture plumbing anyway — that is what
 		// re-derives the static principal its gate checks.
-		mcpSrv.WithGovernanceObserver(auditSink, buildNotifier(os.Getenv, "brain governance edit"))
+		mcpSrv.WithGovernanceObserver(auditSink, buildNotifier())
 		logger.Info("capture enabled (REST + MCP tool)", "sovereign_principals", len(sovereign),
 			"governance_observer", true)
 	} else {
@@ -569,9 +548,9 @@ func main() {
 			logger.Error("OAUTH_CLIENT_ID/SECRET set but MCP_RESOURCE_URL is empty; cannot derive issuer")
 			os.Exit(1)
 		}
-		public["GET /.well-known/oauth-authorization-server"] = http.HandlerFunc(
+		mux.HandleFunc("GET /.well-known/oauth-authorization-server",
 			oauth.MetadataHandler(issuer))
-		public["POST /oauth/token"] = http.HandlerFunc(oauth.TokenHandler(oauth.TokenConfig{
+		mux.HandleFunc("POST /oauth/token", oauth.TokenHandler(oauth.TokenConfig{
 			ClientID:     oauthID,
 			ClientSecret: oauthSecret,
 			AccessToken:  mcpToken,
@@ -584,22 +563,13 @@ func main() {
 		os.Exit(1)
 	}

-	// /metrics — unauthenticated Prometheus endpoint, scraped via the
-	// ServiceMonitor in k3s/apps/supervisor/. buildMux registers it and wraps
-	// the whole router in the registry's middleware.
-	//
-	// The whole router, /mcp's bearer included, is built in buildMux so its
-	// tests are tests of production wiring (PR #152 review, hyperguild#154).
-	// The REST API's credential is the same as /mcp's. Untested here: the
-	// restAuth fields and the public map this call passes in (e.g. a nil
-	// validator would drop JWT auth on /mcp and REST and the suite stays
-	// green), and ListenAndServe serving the result unchanged (hyperguild#182).
-	handler, err := buildMux(restAuth{token: mcpToken, validator: jwtValidator, realm: "brain",
-		resourceMetadataURL: resourceMetadataURL}, h, mcpSrv, metrics.New(), public)
-	if err != nil {
-		logger.Error("build router", "err", err)
-		os.Exit(1)
-	}
+	// /metrics — unauthenticated Prometheus endpoint. kube-prometheus-stack
+	// scrapes it via the ServiceMonitor in k3s/apps/supervisor/. The metrics
+	// middleware below wraps every other registered handler so it observes
+	// real request latency. /metrics itself is excluded from its own
+	// observation by registering it on the outer mux (post-wrap).
+	reg := metrics.New()
+	mux.HandleFunc("GET /metrics", reg.Handler())
 	logger.Info("metrics endpoint registered", "path", "/metrics")

 	addr := ":" + port
@@ -616,7 +586,7 @@ func main() {
 		"watch_interval", watchIntervalLog,
 		"mcp_enabled", true,
 	)
-	if err := http.ListenAndServe(addr, handler); err != nil {
+	if err := http.ListenAndServe(addr, reg.Middleware(mux)); err != nil {
 		logger.Error("server stopped", "err", err)
 		os.Exit(1)
 	}
@@ -6,7 +6,6 @@ import (
 	"log/slog"
 	"os"
 	"path/filepath"
-	"strings"
 	"testing"

 	"github.com/stretchr/testify/assert"
@@ -37,42 +36,3 @@ func TestClaudeSink_IngestWritesToNonIndexedArchiveNotWiki(t *testing.T) {
 	_, err = os.Stat(filepath.Join(dir, "wiki", "claude-sessions"))
 	assert.True(t, os.IsNotExist(err), "raw transcripts must never land under wiki/ (ai-sessions#10 — BM25 pollution)")
 }
-
-// --- #107: an unconfigured alert must announce itself ----------------------
-
-func TestAlertingWarnings(t *testing.T) {
-	tests := []struct {
-		name string
-		env  map[string]string
-		want []string // substrings that must appear across the warnings
-		none bool     // true = expect no warnings at all
-	}{
-		{
-			// The failure this exists to prevent: two alerts dark in
-			// production, discovered only by firing a real event and watching
-			// nothing arrive (#100).
-			name: "notifier unconfigured names what will not fire",
-			env:  map[string]string{},
-			want: []string{"BRAIN_NTFY_URL", "brain_edit_root", "audit"},
-		},
-		{
-			name: "configured notifier is silent",
-			env:  map[string]string{"BRAIN_NTFY_URL": "http://ntfy/brain-alerts"},
-			none: true,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := alertingWarnings(func(k string) string { return tt.env[k] })
-			if tt.none {
-				assert.Empty(t, got)
-				return
-			}
-			joined := strings.Join(got, " ")
-			for _, w := range tt.want {
-				assert.Contains(t, joined, w)
-			}
-		})
-	}
-}
@@ -1,109 +0,0 @@
-package main
-
-import (
-	"errors"
-	"fmt"
-	"net/http"
-
-	chassisauth "git.d-ma.be/mathias/mcp-chassis/auth"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/metrics"
-)
-
-// publicRoutes is the complete set of patterns a caller may register on the
-// outer mux, outside the REST API's auth (hyperguild#149). Each authenticates
-// itself or is meant to be open: /capture (bearer/JWT), the webhook (HMAC),
-// /oauth/token (client secret) and OAuth metadata (open). /mcp and /metrics
-// are not here: buildMux builds them itself (hyperguild#154). A REST pattern
-// added here would beat the authenticated catch-all by specificity and ship
-// open, which is why buildMux refuses anything else.
-var publicRoutes = map[string]bool{
-	"POST /capture":             true,
-	"POST /webhooks/brain-sync": true,
-	"GET /.well-known/oauth-protected-resource":   true,
-	"GET /.well-known/oauth-authorization-server": true,
-	"POST /oauth/token":                           true,
-}
-
-// restAuth is the credential the REST API checks: the same as /mcp's.
-type restAuth struct {
-	token               string
-	validator           *chassisauth.JWTValidator
-	realm               string
-	resourceMetadataURL string
-}
-
-// buildMux builds the handler main passes to ListenAndServe unchanged. The
-// REST API is mounted at "/" and /mcp is registered, both behind bearer auth
-// that buildMux constructs itself from auth (one credential), so a caller
-// cannot pass a no-op. GET /metrics serves reg, and the whole router is
-// wrapped in reg's middleware. Other public handlers are registered as given,
-// and only for patterns on the publicRoutes allowlist. It returns an
-// http.Handler, not the *ServeMux, so nothing can register a route on the
-// result. What stays untested is main's call site: the restAuth fields and
-// the public map main passes in, and ListenAndServe serving this handler
-// unchanged (hyperguild#182). The tests build their own arguments.
-func buildMux(
-	auth restAuth, h *api.Handler, mcpHandler http.Handler, reg *metrics.Registry, public map[string]http.Handler,
-) (http.Handler, error) {
-	if auth.token == "" {
-		return nil, errors.New("buildMux: REST auth needs a token")
-	}
-	if mcpHandler == nil || reg == nil {
-		return nil, errors.New("buildMux: needs the MCP handler and the metrics registry")
-	}
-	mux := http.NewServeMux()
-	for pattern, handler := range public {
-		if !publicRoutes[pattern] {
-			return nil, fmt.Errorf("buildMux: %q is not an allowed public route", pattern)
-		}
-		mux.Handle(pattern, handler)
-	}
-	bearer := func(next http.Handler) http.Handler {
-		return chassisauth.BearerMiddleware(auth.token, auth.validator, auth.realm, auth.resourceMetadataURL, next)
-	}
-	mux.Handle("/mcp", bearer(mcpHandler))
-	// /metrics is registered on the mux and so observed by its own
-	// middleware, like any route.
-	mux.Handle("GET /metrics", reg.Handler())
-	mountREST(mux, h, bearer)
-	return reg.Middleware(mux), nil
-}
-
-// mountREST registers the REST API on its own mux and mounts it at "/" behind
-// auth: anything not registered as public lands here and is authenticated,
-// including routes added later.
-func mountREST(mux *http.ServeMux, h *api.Handler, auth func(http.Handler) http.Handler) {
-	rest := http.NewServeMux()
-	rest.HandleFunc("POST /query", h.Query)
-	rest.HandleFunc("POST /write", h.Write)
-	rest.HandleFunc("POST /index", h.Index)
-	rest.HandleFunc("POST /ingest", h.Ingest)
-	rest.HandleFunc("POST /ingest-path", h.IngestPath)
-	rest.HandleFunc("POST /ingest-raw", h.IngestRaw)
-	rest.HandleFunc("POST /backfill-refs", h.BackfillRefs)
-	rest.HandleFunc("GET /pending", h.Pending)
-	rest.HandleFunc("POST /promote", h.Promote)
-	rest.HandleFunc("POST /backfill-embeddings", h.BackfillEmbeddings)
-	rest.HandleFunc("GET /pass-rate", h.PassRate)
-	mux.Handle("/", labelRESTPattern(rest, auth(rest)))
-}
-
-// labelRESTPattern sets the request's Pattern to the REST route it addresses
-// before auth runs, so the metrics middleware (which reads Pattern from the
-// same *http.Request) labels a refused request by its route rather than by
-// the "/" mount (hyperguild#155). A refused request to a path no route
-// matches keeps "/", so for refused requests the label set stays bounded by
-// the registered routes. That bound does not hold for authenticated
-// requests: an unregistered path reaches the REST mux, which 404s with an
-// empty Pattern, and the metrics middleware falls back to the raw URL path
-// (hyperguild#185).
-func labelRESTPattern(rest *http.ServeMux, next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if _, pattern := rest.Handler(r); pattern != "" {
-			r.Pattern = pattern
-		}
-		next.ServeHTTP(w, r)
-	})
-}
@@ -1,88 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// wrongTokSentinel is a presented credential distinctive enough that any
-// occurrence in a log line is the raw token, not a coincidence.
-const wrongTokSentinel = "wrong-tok-sentinel-q7zx"
-
-// hyperguild#155: since #149 every REST route sits behind BearerMiddleware,
-// and chassis v0.2.0 refused without logging, so an unknown caller got
-// silent 401s. The chassis now writes an `mcp auth rejected` line, and the
-// presented token appears nowhere in the log as a bare value (PR #181
-// review: asserting on the "Bearer " header form could never fail, since
-// the chassis logs fields, not headers).
-func TestBuildMuxRejectionLogLineOmitsTheBarePresentedToken(t *testing.T) {
-	var buf bytes.Buffer
-	prev := slog.Default()
-	slog.SetDefault(slog.New(slog.NewTextHandler(&buf, nil)))
-	t.Cleanup(func() { slog.SetDefault(prev) })
-
-	code, _ := do(t, testMux(t), "POST", "/query", "Bearer "+wrongTokSentinel)
-	require.Equal(t, http.StatusUnauthorized, code)
-	assert.Contains(t, buf.String(), "mcp auth rejected")
-	assert.Contains(t, buf.String(), "path=/query")
-	assert.NotContains(t, buf.String(), wrongTokSentinel, "the rejected token is logged as a bare value")
-	assert.NotContains(t, buf.String(), routesTok, "the valid static token is logged")
-}
-
-// The `mcp auth accepted` line leaves out the valid static token.
-func TestBuildMuxAcceptedLogLineOmitsTheBareStaticToken(t *testing.T) {
-	var buf bytes.Buffer
-	prev := slog.Default()
-	slog.SetDefault(slog.New(slog.NewTextHandler(&buf, nil)))
-	t.Cleanup(func() { slog.SetDefault(prev) })
-
-	code, _ := do(t, testMux(t), "GET", "/pending", "Bearer "+routesTok)
-	require.Equal(t, http.StatusOK, code)
-	assert.Contains(t, buf.String(), "mcp auth accepted")
-	assert.NotContains(t, buf.String(), routesTok, "the accepted static token is logged as a bare value")
-}
-
-// An authenticated REST request is labelled with the REST mux's pattern:
-// the inner mux sets it on the same *http.Request the outer middleware reads.
-func TestMetricsLabelAnAuthenticatedRESTRequestWithItsRoutePattern(t *testing.T) {
-	mux, reg := testMuxAndRegistry(t)
-	code, _ := do(t, mux, "GET", "/pending", "Bearer "+routesTok)
-	require.Equal(t, http.StatusOK, code)
-
-	rec := httptest.NewRecorder()
-	reg.Handler().ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/metrics", nil))
-	assert.Contains(t, rec.Body.String(), `path="GET /pending"`)
-	assert.NotContains(t, rec.Body.String(), `path="/"`)
-}
-
-// hyperguild#155: a request refused by REST auth never reaches the REST mux,
-// so it was labelled path="/" and a 4xx on /query could not be told from one
-// on /write. It is now labelled with the REST pattern it was addressed to.
-func TestMetricsLabelARejectedRESTRequestWithItsRoutePattern(t *testing.T) {
-	mux, reg := testMuxAndRegistry(t)
-	code, _ := do(t, mux, "POST", "/query", "")
-	require.Equal(t, http.StatusUnauthorized, code)
-
-	rec := httptest.NewRecorder()
-	reg.Handler().ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/metrics", nil))
-	assert.Contains(t, rec.Body.String(), `path="POST /query",status="4xx"`)
-}
-
-// A path no REST route matches keeps the catch-all label, so an attacker
-// probing random URLs cannot grow the series set.
-func TestMetricsLabelARejectedUnknownPathWithTheCatchAll(t *testing.T) {
-	mux, reg := testMuxAndRegistry(t)
-	code, _ := do(t, mux, "POST", "/no-such-route-zq", "")
-	require.Equal(t, http.StatusUnauthorized, code)
-
-	rec := httptest.NewRecorder()
-	reg.Handler().ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/metrics", nil))
-	assert.Contains(t, rec.Body.String(), `path="/",status="4xx"`)
-	assert.NotContains(t, rec.Body.String(), "no-such-route-zq")
-}
@@ -1,161 +0,0 @@
-package main
-
-import (
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/metrics"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/pipeline"
-)
-
-const routesTok = "routes-test-token"
-
-func okHandler(body string) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { _, _ = w.Write([]byte(body)) })
-}
-
-// testMux builds the router through buildMux, the function main calls, with
-// every allowlisted public pattern (stub handlers), a stub MCP server and a
-// static token only: no JWT validator and no resourceMetadataURL (the tests
-// in jwt_validator_test.go pass those). It does not use main's own restAuth
-// or public map (hyperguild#182). hyperguild#149: the REST API is
-// authenticated as a whole; the PR #152 review showed a test of a COPY of
-// the router let main.go regress unseen.
-func testMux(t *testing.T) http.Handler {
-	t.Helper()
-	mux, _ := testMuxAndRegistry(t)
-	return mux
-}
-
-func testMuxAndRegistry(t *testing.T) (http.Handler, *metrics.Registry) {
-	t.Helper()
-	public := map[string]http.Handler{}
-	for p := range publicRoutes {
-		public[p] = okHandler("public " + p)
-	}
-	reg := metrics.New()
-	mux, err := buildMux(restAuth{token: routesTok, realm: "brain"}, testHandler(t), okHandler("mcp"), reg, public)
-	require.NoError(t, err)
-	return mux, reg
-}
-
-func testHandler(t *testing.T) *api.Handler {
-	t.Helper()
-	return api.NewHandler(t.TempDir(), slog.New(slog.NewTextHandler(os.Stderr, nil)), pipeline.Config{})
-}
-
-func do(t *testing.T, h http.Handler, method, path, authz string) (int, string) {
-	t.Helper()
-	req := httptest.NewRequest(method, path, strings.NewReader(`{"query":"x"}`))
-	if authz != "" {
-		req.Header.Set("Authorization", authz)
-	}
-	rec := httptest.NewRecorder()
-	h.ServeHTTP(rec, req)
-	return rec.Code, rec.Body.String()
-}
-
-func TestBuildMuxRefusesRESTRoutesWithoutAValidToken(t *testing.T) {
-	r := testMux(t)
-	for _, rt := range []struct{ method, path string }{
-		{"POST", "/query"}, {"POST", "/write"}, {"POST", "/index"}, {"POST", "/ingest"},
-		{"POST", "/ingest-path"}, {"POST", "/ingest-raw"}, {"POST", "/backfill-refs"},
-		{"GET", "/pending"}, {"POST", "/promote"}, {"POST", "/backfill-embeddings"}, {"GET", "/pass-rate"},
-	} {
-		code, _ := do(t, r, rt.method, rt.path, "")
-		assert.Equal(t, http.StatusUnauthorized, code, "%s %s without a token", rt.method, rt.path)
-		code, _ = do(t, r, rt.method, rt.path, "Bearer wrong")
-		assert.Equal(t, http.StatusUnauthorized, code, "%s %s with a wrong token", rt.method, rt.path)
-	}
-}
-
-func TestBuildMuxServesRESTRoutesToAValidToken(t *testing.T) {
-	r := testMux(t)
-	code, _ := do(t, r, "GET", "/pending", "Bearer "+routesTok)
-	assert.Equal(t, http.StatusOK, code)
-}
-
-func TestBuildMuxAuthenticatesAnUnregisteredPath(t *testing.T) {
-	code, _ := do(t, testMux(t), "POST", "/some-future-route", "")
-	assert.Equal(t, http.StatusUnauthorized, code)
-}
-
-// buildMux registers public handlers as given, without adding auth: each
-// public route owns its own (bearer/JWT on /capture, HMAC on the webhook,
-// client secret on /oauth/token) or is meant to be open (OAuth metadata).
-// /mcp and /metrics are not public routes: buildMux builds them itself.
-func TestBuildMuxDoesNotWrapPublicRoutes(t *testing.T) {
-	r := testMux(t)
-	for p := range publicRoutes {
-		method, path, ok := strings.Cut(p, " ")
-		if !ok {
-			method, path = "GET", p
-		}
-		code, body := do(t, r, method, path, "")
-		assert.Equal(t, http.StatusOK, code, p)
-		assert.Equal(t, "public "+p, body, p)
-	}
-}
-
-// The allowlist is the control: a REST pattern registered as public would win
-// over the authenticated catch-all (more specific pattern), so it is refused.
-func TestBuildMuxRefusesAPublicPatternOffTheAllowlist(t *testing.T) {
-	h := api.NewHandler(t.TempDir(), slog.New(slog.NewTextHandler(os.Stderr, nil)), pipeline.Config{})
-	// "/mcp" and "GET /metrics" are built by buildMux itself (hyperguild#154):
-	// passing either as public would register them unauthenticated or twice.
-	for _, p := range []string{"POST /query", "GET /pending", "/", "POST /metrics", "/mcp", "GET /metrics"} {
-		_, err := buildMux(restAuth{token: routesTok, realm: "brain"}, h, okHandler("mcp"), metrics.New(),
-			map[string]http.Handler{p: okHandler("x")})
-		assert.Error(t, err, "public pattern %q must be refused", p)
-	}
-}
-
-func TestBuildMuxRefusesAnEmptyToken(t *testing.T) {
-	h := api.NewHandler(t.TempDir(), slog.New(slog.NewTextHandler(os.Stderr, nil)), pipeline.Config{})
-	_, err := buildMux(restAuth{token: "", realm: "brain"}, h, okHandler("mcp"), metrics.New(), nil)
-	assert.Error(t, err)
-}
-
-// hyperguild#154: /mcp's bearer was built in main.go, untested; the buildMux
-// tests used stubs. buildMux now wraps the MCP handler itself, with the same
-// credential as the REST API.
-func TestBuildMuxRefusesMCPWithoutAValidToken(t *testing.T) {
-	r := testMux(t)
-	for _, authz := range []string{"", "Bearer wrong"} {
-		code, body := do(t, r, "POST", "/mcp", authz)
-		assert.Equal(t, http.StatusUnauthorized, code, "authz %q", authz)
-		assert.NotEqual(t, "mcp", body)
-	}
-	code, body := do(t, r, "POST", "/mcp", "Bearer "+routesTok)
-	assert.Equal(t, http.StatusOK, code)
-	assert.Equal(t, "mcp", body)
-}
-
-func TestBuildMuxRefusesANilMCPHandlerOrRegistry(t *testing.T) {
-	auth := restAuth{token: routesTok, realm: "brain"}
-	_, err := buildMux(auth, testHandler(t), nil, metrics.New(), nil)
-	assert.Error(t, err)
-	_, err = buildMux(auth, testHandler(t), okHandler("mcp"), nil, nil)
-	assert.Error(t, err)
-}
-
-// hyperguild#154: main wrapped buildMux's result in the metrics middleware
-// before ListenAndServe, untested. buildMux now returns the handler main
-// serves as-is, metrics included: a request through it is observed and
-// exposed on its own GET /metrics.
-func TestBuildMuxObservesRequestsAndServesMetrics(t *testing.T) {
-	r := testMux(t)
-	code, _ := do(t, r, "GET", "/pending", "Bearer "+routesTok)
-	require.Equal(t, http.StatusOK, code)
-	code, body := do(t, r, "GET", "/metrics", "")
-	require.Equal(t, http.StatusOK, code)
-	assert.Contains(t, body, `path="GET /pending"`)
-}
@@ -1,39 +0,0 @@
-package main
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"strconv"
-	"time"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/symlinkguard"
-)
-
-// startupSymlinkCheck is the hyperguild#157 tripwire at boot: a symlink in the
-// brain dir would let brain readers serve a file from outside the brain, so
-// the server does not start until it is removed. A directory the scan cannot
-// read could hide one, so it refuses on that too. A missing brain dir (first
-// boot) is the only case it lets pass.
-func startupSymlinkCheck(brainDir string) error {
-	r, err := symlinkguard.Scan(brainDir)
-	if err != nil {
-		if errors.Is(err, os.ErrNotExist) {
-			return nil
-		}
-		return fmt.Errorf("refusing to start: cannot scan the brain dir %s (hyperguild#157): %w", brainDir, err)
-	}
-	if !r.Clean() {
-		return fmt.Errorf("refusing to start: brain dir %s has %s (hyperguild#157); fix them first", brainDir, r)
-	}
-	return nil
-}
-
-// symlinkScanInterval reads BRAIN_SYMLINK_SCAN_INTERVAL (seconds), falling
-// back to the default on an unset, non-numeric or non-positive value.
-func symlinkScanInterval(getenv func(string) string) time.Duration {
-	if s, err := strconv.Atoi(getenv("BRAIN_SYMLINK_SCAN_INTERVAL")); err == nil && s > 0 {
-		return time.Duration(s) * time.Second
-	}
-	return symlinkguard.DefaultInterval
-}
@@ -1,92 +0,0 @@
-package main
-
-import (
-	"context"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"strings"
-	"syscall"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// hyperguild#157: the server refuses to start while a symlink exists in the
-// brain dir, or while any part of it cannot be scanned (which could hide
-// one); a missing brain dir is the only thing it lets pass.
-func TestStartupSymlinkCheckRefusesABrainWithASymlink(t *testing.T) {
-	brain := t.TempDir()
-	require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(brain, "planted")))
-	err := startupSymlinkCheck(brain)
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "planted")
-}
-
-func TestStartupSymlinkCheckRefusesABrainWithAnUnreadableDir(t *testing.T) {
-	if os.Geteuid() == 0 {
-		t.Skip("root reads mode-000 directories")
-	}
-	brain := t.TempDir()
-	locked := filepath.Join(brain, "aaa")
-	require.NoError(t, os.MkdirAll(locked, 0o755))
-	require.NoError(t, os.Chmod(locked, 0o000))
-	t.Cleanup(func() { _ = os.Chmod(locked, 0o755) })
-	err := startupSymlinkCheck(brain)
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "aaa")
-}
-
-func TestStartupSymlinkCheckPassesACleanOrMissingBrain(t *testing.T) {
-	brain := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(brain, "n.md"), []byte("x"), 0o644))
-	assert.NoError(t, startupSymlinkCheck(brain))
-	assert.NoError(t, startupSymlinkCheck(filepath.Join(brain, "missing")))
-}
-
-func TestSymlinkScanIntervalFallsBackOnNonPositive(t *testing.T) {
-	for _, v := range []string{"0", "-5", "", "junk"} {
-		got := symlinkScanInterval(func(string) string { return v })
-		assert.Positive(t, got, "env %q", v)
-	}
-}
-
-func TestAlertingWarningsNamesTheSymlinkTripwire(t *testing.T) {
-	w := strings.Join(alertingWarnings(func(string) string { return "" }), " ")
-	assert.Contains(t, w, "symlink tripwire")
-}
-
-func TestStartupSymlinkCheckRefusesAnUnlistableBrainRoot(t *testing.T) {
-	if os.Geteuid() == 0 {
-		t.Skip("root lists mode-0100 directories")
-	}
-	brain := t.TempDir()
-	require.NoError(t, os.Chmod(brain, 0o100))
-	t.Cleanup(func() { _ = os.Chmod(brain, 0o755) })
-	assert.Error(t, startupSymlinkCheck(brain))
-}
-
-// hyperguild#179: a FIFO in the brain is refused at startup with a clear
-// message, instead of hanging or exiting later in a reader.
-func TestStartupSymlinkCheckRefusesABrainWithAFIFO(t *testing.T) {
-	brain := t.TempDir()
-	require.NoError(t, syscall.Mkfifo(filepath.Join(brain, "classification.yaml"), 0o644))
-	err := startupSymlinkCheck(brain)
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "classification.yaml")
-}
-
-// hyperguild#163: each alert source gets its own ntfy title.
-func TestBuildNotifierUsesTheGivenTitle(t *testing.T) {
-	var got string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { got = r.Header.Get("Title") }))
-	defer srv.Close()
-	env := map[string]string{"BRAIN_NTFY_URL": srv.URL}
-	n := buildNotifier(func(k string) string { return env[k] }, "brain symlink tripwire")
-	require.NotNil(t, n)
-	require.NoError(t, n.Notify(context.Background(), "m"))
-	assert.Equal(t, "brain symlink tripwire", got)
-	assert.Nil(t, buildNotifier(func(string) string { return "" }, "x"), "no ntfy URL, no notifier")
-}
@@ -34,9 +34,9 @@ require (
 	github.com/rogpeppe/go-internal v1.15.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
-	golang.org/x/net v0.55.0 // indirect
+	golang.org/x/net v0.26.0 // indirect
 	golang.org/x/oauth2 v0.21.0 // indirect
-	golang.org/x/term v0.43.0 // indirect
+	golang.org/x/term v0.28.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
 	google.golang.org/protobuf v1.34.2 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
@@ -51,7 +51,7 @@ require (
 )

 require (
-	git.d-ma.be/mathias/mcp-chassis v0.7.1
+	git.d-ma.be/mathias/mcp-chassis v0.2.0
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
 	github.com/goccy/go-json v0.10.3 // indirect
@@ -66,9 +66,9 @@ require (
 	github.com/lestrrat-go/option v1.0.1 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/segmentio/asm v1.2.0 // indirect
-	golang.org/x/crypto v0.51.0 // indirect
-	golang.org/x/sync v0.21.0 // indirect
-	golang.org/x/sys v0.45.0
-	golang.org/x/text v0.39.0 // indirect
+	golang.org/x/crypto v0.32.0 // indirect
+	golang.org/x/sync v0.17.0 // indirect
+	golang.org/x/sys v0.31.0 // indirect
+	golang.org/x/text v0.29.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1
 )
@@ -1,5 +1,5 @@
-git.d-ma.be/mathias/mcp-chassis v0.7.1 h1:4h8TOBHTA0L/no4IPcr4tLcQtmKUlhE2/cXyPdNFGmM=
-git.d-ma.be/mathias/mcp-chassis v0.7.1/go.mod h1:Ks7EK2UnGAN0H3rJjKUxUagX8/ZBdtLrOlcUbv0RwH8=
+git.d-ma.be/mathias/mcp-chassis v0.2.0 h1:6fLmb7xqRa2nNVWsHaUbbfbArgDXJw/gDhb09clBIjo=
+git.d-ma.be/mathias/mcp-chassis v0.2.0/go.mod h1:Ks7EK2UnGAN0H3rJjKUxUagX8/ZBdtLrOlcUbv0RwH8=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -117,42 +117,42 @@ github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9dec
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
-golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
+golang.org/x/crypto v0.32.0 h1:euUpcYgM8WcP71gNpTqQCn6rC2t6ULUPiOzfWaXVVfc=
+golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
-golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
+golang.org/x/net v0.26.0 h1:soB7SVo0PWrY4vPW/+ay0jKDNScG2X9wFeYlXIvJsOQ=
+golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
 golang.org/x/oauth2 v0.21.0 h1:tsimM75w1tF/uws5rbeHzIWxEqElMehnc+iW793zsZs=
 golang.org/x/oauth2 v0.21.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
-golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
+golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
-golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
-golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
+golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
+golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/term v0.28.0 h1:/Ts8HFuMR2E6IP/jlo7QVLZHggjKQbhu/7H0LJFr3Gg=
+golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus=
-golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM=
+golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk=
+golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4=
 golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
 golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
-golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg=
+golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1,12 +1,6 @@
 package api

-import (
-	"strings"
-
-	// Aliased: this package's own frontmatter type (below) would collide
-	// with the imported package's name otherwise.
-	sharedfm "github.com/mathiasbq/hyperguild/ingestion/internal/frontmatter"
-)
+import "strings"

 // frontmatter is an ordered, line-preserving view of a note's YAML
 // frontmatter block. It deliberately avoids a full YAML round-trip: the
@@ -31,26 +25,19 @@ type fmLine struct {
 // frontmatter block is recognised only when the file opens with a `---`
 // fence and a closing `---` fence follows. Otherwise the whole input is
 // the body and the returned frontmatter is empty.
-//
-// Fence detection itself is frontmatter.Split (hyperguild#138) — this
-// package's own contribution is purely the ordered, line-preserving fmLine
-// shape below, which a shared parser has no business owning since it's
-// specific to how brain_update does a surgical, byte-round-trip edit.
 func parseFrontmatter(src string) (frontmatter, string) {
 	var fm frontmatter
-	blockBytes, restBytes, ok := sharedfm.Split([]byte(src))
-	if !ok {
+	if !strings.HasPrefix(src, "---\n") {
 		return fm, src
 	}
-	// sharedfm.Split's block/rest boundary sits one byte earlier than this
-	// package's always has: block keeps the "\n" immediately before the
-	// closing fence, and rest keeps the "\n" immediately after it (both by
-	// design, for Fix's own reconstruction). This package's block/body
-	// never included either — TrimSuffix/TrimPrefix restore that exact
-	// boundary. Split guarantees ok=true only when "\n---\n" matched, so
-	// both trims are always exactly one byte, never ambiguous.
-	block := strings.TrimSuffix(string(blockBytes), "\n")
-	body := strings.TrimPrefix(string(restBytes), "\n")
+	rest := src[len("---\n"):]
+	end := strings.Index(rest, "\n---\n")
+	if end < 0 {
+		// Opening fence with no closing fence — treat as bodyless content.
+		return fm, src
+	}
+	block := rest[:end]
+	body := rest[end+len("\n---\n"):]

 	for _, line := range strings.Split(block, "\n") {
 		// An indented line is a continuation (a YAML block-list item, a
@@ -12,8 +12,8 @@ import (
 	"time"

 	"github.com/mathiasbq/hyperguild/ingestion/internal/brain"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/claim"
+	"github.com/mathiasbq/hyperguild/ingestion/internal/extract"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/pipeline"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/search"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/vectorstore"
@@ -118,11 +118,6 @@ type WriteNoteOptions struct {
 	Wing       string
 	Hall       string
 	SourceType string // "internal" marks a first-party observation (e.g. claudewatcher) that needs no external citation
-	// Origin/WrittenBy are server-owned provenance (hyperguild#145): any
-	// origin/written_by in Content's own frontmatter is discarded, so a
-	// caller cannot claim a more trusted origin than it authenticated as.
-	Origin    string
-	WrittenBy string
 }

 // WriteNote writes a markdown note into the brain. Returns the path
@@ -174,6 +169,9 @@ func writeHallNote(brainDir string, opts WriteNoteOptions) (string, error) {
 		return "", fmt.Errorf("claim envelope: %w", err)
 	}

+	if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
+		return "", fmt.Errorf("create hall dir: %w", err)
+	}
 	emitted := make(map[string]bool, 6)

 	var fm strings.Builder
@@ -221,29 +219,11 @@ func writeHallNote(brainDir string, opts WriteNoteOptions) (string, error) {
 	}
 	fm.WriteString("---\n")

-	final, err := StampProvenance(fm.String()+body, opts.Origin, opts.WrittenBy)
-	if err != nil {
-		return "", err
-	}
-	// The directory is created only once the note is known to be writable:
-	// a refused write leaves nothing behind, not even an empty hall dir
-	// (brain#21; provenance refusal joins the envelope refusal here).
-	// Created through the brain root, never through a symlinked wing or
-	// hall directory (hyperguild#188).
-	rel, err := filepath.Rel(brainDir, dest)
-	if err != nil {
-		return "", fmt.Errorf("note path: %w", err)
-	}
-	rel = filepath.ToSlash(rel)
-	bfs, err := brainfs.Open(brainDir)
-	if err != nil {
-		return "", fmt.Errorf("open brain: %w", err)
-	}
-	defer func() { _ = bfs.Close() }()
-	if err := bfs.PutRegular(rel, []byte(final)); err != nil {
+	if err := os.WriteFile(dest, []byte(fm.String()+body), 0o644); err != nil {
 		return "", fmt.Errorf("write: %w", err)
 	}
-	return rel, nil
+	rel, _ := filepath.Rel(brainDir, dest)
+	return filepath.ToSlash(rel), nil
 }

 // scalarValues flattens frontmatter fields to key -> scalar value for
@@ -315,16 +295,7 @@ func (h *Handler) Write(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, "invalid JSON")
 		return
 	}
-	// Field by field, not a struct conversion: provenance is server-owned and
-	// this door carries no principal, so it stamps origin: unknown
-	// (hyperguild#145). A JSON body must never be able to set it.
-	relPath, err := WriteNote(h.brainDir, WriteNoteOptions{
-		Content:    req.Content,
-		Filename:   req.Filename,
-		Wing:       req.Wing,
-		Hall:       req.Hall,
-		SourceType: req.SourceType,
-	})
+	relPath, err := WriteNote(h.brainDir, WriteNoteOptions(req))
 	if err != nil {
 		h.logger.Error("write failed", "err", err)
 		writeError(w, http.StatusBadRequest, err.Error())
@@ -455,12 +426,6 @@ func (h *Handler) IngestPath(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, "path is required")
 		return
 	}
-	resolved, err := ResolveIngestPath(h.brainDir, req.Path)
-	if err != nil {
-		writeError(w, http.StatusBadRequest, err.Error())
-		return
-	}
-	req.Path = resolved

 	info, err := os.Stat(req.Path)
 	if err != nil {
@@ -483,13 +448,7 @@ func (h *Handler) IngestPath(w http.ResponseWriter, r *http.Request) {
 			if !isSupportedExtension(ext) {
 				return nil
 			}
-			// Each walked file is re-resolved: a symlinked file inside raw/
-			// would otherwise lead extract.Text out of the inbox (#149).
-			if _, rerr := ResolveIngestPath(h.brainDir, path); rerr != nil {
-				allWarnings = append(allWarnings, fmt.Sprintf("skipped %s: %v", path, rerr))
-				return nil
-			}
-			content, readErr := ReadIngestFile(h.brainDir, path)
+			content, readErr := extract.Text(path)
 			if readErr != nil {
 				allWarnings = append(allWarnings, fmt.Sprintf("extract %s: %v", path, readErr))
 				return nil
@@ -518,7 +477,7 @@ func (h *Handler) IngestPath(w http.ResponseWriter, r *http.Request) {
 			writeError(w, http.StatusBadRequest, fmt.Sprintf("unsupported file extension: %s", ext))
 			return
 		}
-		content, readErr := ReadIngestFile(h.brainDir, req.Path)
+		content, readErr := extract.Text(req.Path)
 		if readErr != nil {
 			writeError(w, http.StatusInternalServerError, fmt.Sprintf("extract text: %v", readErr))
 			return
@@ -570,8 +529,7 @@ func (h *Handler) IngestRaw(w http.ResponseWriter, r *http.Request) {
 		return
 	}

-	// No principal on this door: pages are stamped origin: unknown (#145).
-	result, err := pipeline.RunRaw(r.Context(), h.brainDir, req.Source, req.Pages, req.DryRun)
+	result, err := pipeline.RunRaw(h.brainDir, req.Source, req.Pages, req.DryRun)
 	if err != nil {
 		h.logger.Error("ingest-raw failed", "source", req.Source, "err", err)
 		writeError(w, http.StatusInternalServerError, "ingest error")
@@ -627,11 +585,7 @@ func (h *Handler) Promote(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, "invalid JSON")
 		return
 	}
-	// Field by field: this door carries no principal, so the promoted note is
-	// stamped origin: unknown and the body cannot set provenance (#145).
-	rel, err := PromoteNote(h.brainDir, PromoteOptions{
-		Filename: req.Filename, Wing: req.Wing, Hall: req.Hall, Slug: req.Slug,
-	})
+	rel, err := PromoteNote(h.brainDir, PromoteOptions(req))
 	if err != nil {
 		writeError(w, http.StatusBadRequest, err.Error())
 		return
@@ -361,11 +361,10 @@ func TestIngestPath_MissingPath(t *testing.T) {
 }

 func TestIngestPath_File(t *testing.T) {
-	brainDir, h := setup(t)
+	_, h := setup(t)

 	// Create a temp file with content
-	dir := filepath.Join(brainDir, "raw", "fixture") // ingest paths must live in brain/raw/ (#149)
-	require.NoError(t, os.MkdirAll(dir, 0o755))
+	dir := t.TempDir()
 	f := filepath.Join(dir, "doc.md")
 	require.NoError(t, os.WriteFile(f, []byte("# Hello\nThis is markdown content."), 0o644))

@@ -469,11 +468,10 @@ func TestIngestRaw_DryRun(t *testing.T) {
 }

 func TestIngestPath_Directory(t *testing.T) {
-	brainDir, h := setup(t)
+	_, h := setup(t)

 	// Create a temp dir with one .md file
-	dir := filepath.Join(brainDir, "raw", "fixture") // ingest paths must live in brain/raw/ (#149)
-	require.NoError(t, os.MkdirAll(dir, 0o755))
+	dir := t.TempDir()
 	require.NoError(t, os.WriteFile(filepath.Join(dir, "notes.md"), []byte("# Notes\nSome notes."), 0o644))

 	body, _ := json.Marshal(map[string]any{
@@ -40,10 +40,9 @@ func TestIngestPath_DocxSupportedWhenDocmarkConfigured(t *testing.T) {
 	t.Setenv("DOCMARK_URL", srv.URL+"/mcp")
 	t.Setenv("DOCMARK_BEARER_TOKEN", "tok")

-	brainDir, h := setup(t)
+	_, h := setup(t)

-	dir := filepath.Join(brainDir, "raw", "fixture") // ingest paths must live in brain/raw/ (#149)
-	require.NoError(t, os.MkdirAll(dir, 0o755))
+	dir := t.TempDir()
 	f := filepath.Join(dir, "doc.docx")
 	require.NoError(t, os.WriteFile(f, []byte("fake docx"), 0o644))

@@ -1,67 +0,0 @@
-package api
-
-import (
-	"errors"
-	"os"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/extract"
-	"path/filepath"
-	"strings"
-)
-
-// ErrOutsideIngestRoot is the one refusal for every bad ingest path. It never
-// carries the underlying error: "no such file" versus "permission denied"
-// would let a caller probe which server files exist (PR #152 review).
-var ErrOutsideIngestRoot = errors.New("ingest path must be an existing file or directory inside brain/raw/")
-
-// ResolveIngestPath confines a caller-supplied ingest path to brain/raw/, the
-// inbox the watcher already owns (hyperguild#149). Relative paths resolve
-// against that root; symlinks are evaluated before the containment check, so
-// a link inside raw/ that points elsewhere is refused. The path must exist.
-func ResolveIngestPath(brainDir, p string) (string, error) {
-	if strings.TrimSpace(p) == "" {
-		return "", ErrOutsideIngestRoot
-	}
-	// raw/ itself must be a real directory: if it were a symlink, containment
-	// inside it would mean nothing (hyperguild#153 item 4).
-	if fi, lerr := os.Lstat(filepath.Join(brainDir, "raw")); lerr != nil || fi.Mode()&os.ModeSymlink != 0 || !fi.IsDir() {
-		return "", ErrOutsideIngestRoot
-	}
-	root, err := filepath.EvalSymlinks(filepath.Join(brainDir, "raw"))
-	if err != nil {
-		return "", ErrOutsideIngestRoot
-	}
-	if !filepath.IsAbs(p) {
-		p = filepath.Join(root, p)
-	}
-	real, err := filepath.EvalSymlinks(filepath.Clean(p))
-	if err != nil {
-		return "", ErrOutsideIngestRoot
-	}
-	rel, err := filepath.Rel(root, real)
-	if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) || filepath.IsAbs(rel) {
-		return "", ErrOutsideIngestRoot
-	}
-	return real, nil
-}
-
-// ReadIngestFile extracts text from an ingest path already confined by
-// ResolveIngestPath, reading it through the raw/ root rather than reopening
-// the path by name (hyperguild#153 item 3): if the file is swapped for a
-// symlink after the check, the read still cannot leave raw/.
-func ReadIngestFile(brainDir, resolved string) (string, error) {
-	root, rawPath, err := OpenRawRoot(brainDir)
-	if err != nil {
-		return "", ErrOutsideIngestRoot
-	}
-	defer func() { _ = root.Close() }()
-	realRoot, err := filepath.EvalSymlinks(rawPath)
-	if err != nil {
-		return "", ErrOutsideIngestRoot
-	}
-	rel, err := filepath.Rel(realRoot, resolved)
-	if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) || filepath.IsAbs(rel) {
-		return "", ErrOutsideIngestRoot
-	}
-	return extract.TextIn(root, rel)
-}
@@ -1,88 +0,0 @@
-package api_test
-
-import (
-	"bytes"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
-)
-
-// hyperguild#149: /ingest-path and MCP brain_ingest read a caller-chosen
-// server path, so any file the pod could read (the ServiceAccount token,
-// /etc/passwd) could be pulled into the brain and read back out. Ingest paths
-// now resolve inside brain/raw/ — the inbox the watcher already owns — with
-// symlinks evaluated, or are refused.
-func TestResolveIngestPathConfinesToRawInbox(t *testing.T) {
-	brain := t.TempDir()
-	raw := filepath.Join(brain, "raw")
-	require.NoError(t, os.MkdirAll(filepath.Join(raw, "sub"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(raw, "sub", "ok.md"), []byte("x"), 0o644))
-	outside := filepath.Join(t.TempDir(), "secret.txt")
-	require.NoError(t, os.WriteFile(outside, []byte("s"), 0o644))
-	require.NoError(t, os.Symlink(outside, filepath.Join(raw, "link.md")))
-	require.NoError(t, os.Symlink(filepath.Dir(outside), filepath.Join(raw, "dirlink")))
-
-	for _, ok := range []string{filepath.Join(raw, "sub", "ok.md"), "sub/ok.md", raw, "sub"} {
-		_, err := api.ResolveIngestPath(brain, ok)
-		assert.NoError(t, err, ok)
-	}
-	for _, bad := range []string{
-		"/etc/hostname", outside, "../secret.txt", filepath.Join(raw, "..", "wiki"),
-		filepath.Join(raw, "link.md"), filepath.Join(raw, "dirlink", "secret.txt"),
-		raw + "-evil/x.md", "",
-	} {
-		_, err := api.ResolveIngestPath(brain, bad)
-		assert.Error(t, err, "must refuse %q", bad)
-	}
-}
-
-func TestIngestPathRefusesAPathOutsideTheInbox(t *testing.T) {
-	_, h := setup(t)
-	body, _ := json.Marshal(map[string]any{"path": "/etc/hostname"})
-	rec := httptest.NewRecorder()
-	h.IngestPath(rec, httptest.NewRequest(http.MethodPost, "/ingest-path", bytes.NewReader(body)))
-	assert.Equal(t, http.StatusBadRequest, rec.Code)
-	assert.Contains(t, rec.Body.String(), "raw")
-}
-
-// A directory ingest must not follow a symlinked FILE inside raw/ out of it.
-func TestIngestPathDirectoryWalkSkipsSymlinksLeavingTheInbox(t *testing.T) {
-	dir, h := setup(t)
-	raw := filepath.Join(dir, "raw", "batch")
-	require.NoError(t, os.MkdirAll(raw, 0o755))
-	outside := filepath.Join(t.TempDir(), "secret.md")
-	require.NoError(t, os.WriteFile(outside, []byte("# secret\n\nSENTINEL-149-OUTSIDE"), 0o644))
-	require.NoError(t, os.Symlink(outside, filepath.Join(raw, "leak.md")))
-	body, _ := json.Marshal(map[string]any{"path": "batch", "source": "walk"})
-	rec := httptest.NewRecorder()
-	h.IngestPath(rec, httptest.NewRequest(http.MethodPost, "/ingest-path", bytes.NewReader(body)))
-	assert.Contains(t, rec.Body.String(), "skipped")
-	assert.NotContains(t, rec.Body.String(), "SENTINEL-149-OUTSIDE")
-}
-
-// PR #152 review: the raw EvalSymlinks error told an authenticated caller
-// whether any server file existed ("no such file") or was unreadable
-// ("permission denied"), and leaked the brain directory. Every refusal now
-// reads the same.
-func TestResolveIngestPathRefusalsAreIndistinguishable(t *testing.T) {
-	brain := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(brain, "raw"), 0o755))
-	var msgs []string
-	for _, p := range []string{"/etc/hostname", "/etc/definitely-not-here-149", "../x", "nope/missing.md", ""} {
-		_, err := api.ResolveIngestPath(brain, p)
-		require.Error(t, err, p)
-		msgs = append(msgs, err.Error())
-		assert.NotContains(t, err.Error(), brain, "refusal for %q leaks the brain dir", p)
-	}
-	for _, m := range msgs[1:] {
-		assert.Equal(t, msgs[0], m)
-	}
-}
@@ -1,9 +1,7 @@
 package api

 import (
-	"errors"
 	"fmt"
-	"io/fs"
 	"os"
 	"path/filepath"
 	"regexp"
@@ -30,25 +28,25 @@ var datePrefix = regexp.MustCompile(`^\d{4}-\d{2}-\d{2}-`)
 // (natural review order). An absent raw/ dir yields an empty slice, not an
 // error. Only .md files are listed; tunnel-candidate files are skipped.
 func ListPending(brainDir string) ([]PendingNote, error) {
-	root, _, err := OpenRawRoot(brainDir)
+	dir := filepath.Join(brainDir, "raw")
+	entries, err := os.ReadDir(dir)
 	if err != nil {
-		if errors.Is(err, os.ErrNotExist) {
+		if os.IsNotExist(err) {
 			return []PendingNote{}, nil
 		}
 		return nil, fmt.Errorf("read raw dir: %w", err)
 	}
-	defer func() { _ = root.Close() }()
-	entries, err := fs.ReadDir(root.FS(), ".")
-	if err != nil {
-		return nil, fmt.Errorf("read raw dir: %w", err)
-	}

 	out := make([]PendingNote, 0, len(entries))
 	for _, e := range entries {
-		if !e.Type().IsRegular() || !strings.HasSuffix(e.Name(), ".md") || strings.HasPrefix(e.Name(), "tunnel-candidates-") {
-			continue // directories, and symlinks whose target may be anywhere (#153)
+		if e.IsDir() || !strings.HasSuffix(e.Name(), ".md") || strings.HasPrefix(e.Name(), "tunnel-candidates-") {
+			continue
 		}
-		raw, info, readErr := readRawNote(root, e.Name())
+		info, statErr := e.Info()
+		if statErr != nil {
+			continue
+		}
+		raw, readErr := os.ReadFile(filepath.Join(dir, e.Name()))
 		if readErr != nil {
 			continue
 		}
@@ -74,10 +72,6 @@ type PromoteOptions struct {
 	Wing     string
 	Hall     string
 	Slug     string // optional; defaults to Filename minus date prefix + .md
-	// Origin/WrittenBy re-attribute the promoted note to the promoter: the raw
-	// note's own frontmatter claims are not provenance (hyperguild#145).
-	Origin    string
-	WrittenBy string
 }

 // PromoteNote moves a note from brain/raw/ into the structured wiki: it
@@ -107,9 +101,12 @@ func PromoteNote(brainDir string, opts PromoteOptions) (string, error) {
 	}

 	src := filepath.Join(brainDir, "raw", base)
-	raw, err := readRawSource(brainDir, base)
+	raw, err := os.ReadFile(src)
 	if err != nil {
-		return "", err
+		if os.IsNotExist(err) {
+			return "", fmt.Errorf("pending note %q does not exist in raw/", base)
+		}
+		return "", fmt.Errorf("read source: %w", err)
 	}

 	// Collision: never silently overwrite an existing promoted note.
@@ -127,18 +124,14 @@ func PromoteNote(brainDir string, opts PromoteOptions) (string, error) {
 	}
 	fm.set("promoted_at", now)

-	// Write-then-delete: the source survives any write failure. Both go
-	// through the brain root (hyperguild#188).
-	promoted, err := StampProvenance(fm.render()+body, opts.Origin, opts.WrittenBy)
-	if err != nil {
-		return "", err
+	if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
+		return "", fmt.Errorf("create wing dir: %w", err)
 	}
-	// Created with O_EXCL: a note that appeared after the collision check
-	// above is never overwritten.
-	if err := createBrainFile(brainDir, dest, []byte(promoted)); err != nil {
+	// Write-then-delete: the source survives any write failure.
+	if err := os.WriteFile(dest, []byte(fm.render()+body), 0o644); err != nil {
 		return "", fmt.Errorf("write promoted note: %w", err)
 	}
-	if err := removeBrainFile(brainDir, src); err != nil {
+	if err := os.Remove(src); err != nil {
 		return "", fmt.Errorf("promoted note written but source removal failed: %w", err)
 	}

@@ -179,9 +172,12 @@ func RejectNote(brainDir string, opts RejectOptions) (string, error) {
 	}

 	src := filepath.Join(brainDir, "raw", base)
-	raw, err := readRawSource(brainDir, base)
+	raw, err := os.ReadFile(src)
 	if err != nil {
-		return "", err
+		if os.IsNotExist(err) {
+			return "", fmt.Errorf("pending note %q does not exist in raw/", base)
+		}
+		return "", fmt.Errorf("read source: %w", err)
 	}

 	dest := filepath.Join(brainDir, "raw", "rejected", base)
@@ -196,12 +192,14 @@ func RejectNote(brainDir string, opts RejectOptions) (string, error) {
 		fm.set("reject_reason", opts.Reason)
 	}

-	// Write-then-delete: the source survives any write failure. Both go
-	// through the brain root (hyperguild#188).
-	if err := createBrainFile(brainDir, dest, []byte(fm.render()+body)); err != nil {
+	if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
+		return "", fmt.Errorf("create rejected dir: %w", err)
+	}
+	// Write-then-delete: the source survives any write failure.
+	if err := os.WriteFile(dest, []byte(fm.render()+body), 0o644); err != nil {
 		return "", fmt.Errorf("write rejected note: %w", err)
 	}
-	if err := removeBrainFile(brainDir, src); err != nil {
+	if err := os.Remove(src); err != nil {
 		return "", fmt.Errorf("rejected note written but source removal failed: %w", err)
 	}

@@ -218,24 +216,3 @@ func excerpt(s string, n int) string {
 	}
 	return strings.TrimSpace(string(r))
 }
-
-// readRawSource reads a pending note for promote/reject through the raw root,
-// refusing symlinks and a symlinked raw/ (hyperguild#153).
-func readRawSource(brainDir, base string) ([]byte, error) {
-	root, _, err := OpenRawRoot(brainDir)
-	if err != nil {
-		if errors.Is(err, os.ErrNotExist) {
-			return nil, fmt.Errorf("pending note %q does not exist in raw/", base)
-		}
-		return nil, fmt.Errorf("read source: %w", err)
-	}
-	defer func() { _ = root.Close() }()
-	raw, _, err := readRawNote(root, base)
-	if err != nil {
-		if errors.Is(err, os.ErrNotExist) {
-			return nil, fmt.Errorf("pending note %q does not exist in raw/", base)
-		}
-		return nil, fmt.Errorf("read source: %w", err)
-	}
-	return raw, nil
-}
@@ -1,87 +0,0 @@
-package api_test
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
-)
-
-// hyperguild#188: promote and reject wrote the destination with
-// os.MkdirAll + os.WriteFile by path, so a symlinked wing (promote) or a
-// symlinked raw/rejected (reject) redirected the note; the raw source was
-// then removed.
-func TestPromoteAndRejectRefuseASymlinkedDestinationDirectory(t *testing.T) {
-	brain := t.TempDir()
-	outside := t.TempDir()
-	raw := filepath.Join(brain, "raw")
-	require.NoError(t, os.MkdirAll(raw, 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(raw, "2026-10-05-n.md"), []byte("---\ntitle: n\n---\nbody\n"), 0o644))
-	require.NoError(t, os.MkdirAll(filepath.Join(brain, "wiki"), 0o755))
-	require.NoError(t, os.Symlink(outside, filepath.Join(brain, "wiki", "lw")))
-	require.NoError(t, os.Symlink(outside, filepath.Join(raw, "rejected")))
-
-	_, err := api.PromoteNote(brain, api.PromoteOptions{Filename: "2026-10-05-n.md", Wing: "lw", Hall: "facts"})
-	assert.Error(t, err)
-	_, err = api.RejectNote(brain, api.RejectOptions{Filename: "2026-10-05-n.md"})
-	assert.Error(t, err)
-	ents, _ := os.ReadDir(outside)
-	assert.Empty(t, ents, "a note was written outside the brain")
-	_, err = os.Stat(filepath.Join(raw, "2026-10-05-n.md"))
-	assert.NoError(t, err, "the raw source is kept when the write is refused")
-
-	require.NoError(t, os.Remove(filepath.Join(raw, "rejected")))
-	_, err = api.PromoteNote(brain, api.PromoteOptions{Filename: "2026-10-05-n.md", Wing: "w", Hall: "facts"})
-	require.NoError(t, err, "positive control: promote into a real wing")
-}
-
-// StampProvenanceFile read and rewrote the note by path (provenance.ApplyFile).
-func TestStampProvenanceFileRefusesANoteBehindASymlinkedDirectory(t *testing.T) {
-	brain := t.TempDir()
-	victim := filepath.Join(brain, "raw", "facts", "v.md")
-	require.NoError(t, os.MkdirAll(filepath.Dir(victim), 0o755))
-	require.NoError(t, os.WriteFile(victim, []byte("---\ntitle: v\n---\nuntouched\n"), 0o644))
-	require.NoError(t, os.MkdirAll(filepath.Join(brain, "wiki", "w"), 0o755))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "raw", "facts"), filepath.Join(brain, "wiki", "w", "alias")))
-	assert.Error(t, api.StampProvenanceFile(brain, "wiki/w/alias/v.md", "static", "x"))
-	got, _ := os.ReadFile(victim)
-	assert.Equal(t, "---\ntitle: v\n---\nuntouched\n", string(got))
-
-	real := filepath.Join(brain, "wiki", "w", "facts", "r.md")
-	require.NoError(t, os.MkdirAll(filepath.Dir(real), 0o755))
-	require.NoError(t, os.WriteFile(real, []byte("---\ntitle: r\n---\nbody\n"), 0o644))
-	require.NoError(t, api.StampProvenanceFile(brain, "wiki/w/facts/r.md", "static", "x"), "positive control")
-	got, _ = os.ReadFile(real)
-	assert.Contains(t, string(got), "written_by: x")
-}
-
-// The same through an in-brain symlinked wing and raw/rejected, which
-// os.Root alone would follow.
-func TestPromoteAndRejectRefuseAnInBrainSymlinkedDestinationDirectory(t *testing.T) {
-	brain := t.TempDir()
-	raw := filepath.Join(brain, "raw")
-	require.NoError(t, os.MkdirAll(raw, 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(raw, "2026-10-05-n.md"), []byte("---\ntitle: n\n---\nbody\n"), 0o644))
-	target := filepath.Join(brain, "archive")
-	require.NoError(t, os.MkdirAll(target, 0o755))
-	require.NoError(t, os.MkdirAll(filepath.Join(brain, "wiki"), 0o755))
-	require.NoError(t, os.Symlink(filepath.Join("..", "archive"), filepath.Join(brain, "wiki", "lw")))
-	require.NoError(t, os.Symlink(filepath.Join("..", "archive"), filepath.Join(raw, "rejected")))
-
-	_, err := api.PromoteNote(brain, api.PromoteOptions{Filename: "2026-10-05-n.md", Wing: "lw", Hall: "facts"})
-	assert.Error(t, err)
-	_, err = api.RejectNote(brain, api.RejectOptions{Filename: "2026-10-05-n.md"})
-	assert.Error(t, err)
-	ents, _ := os.ReadDir(target)
-	assert.Empty(t, ents, "a note was written at the in-brain link's target")
-	_, err = os.Stat(filepath.Join(raw, "2026-10-05-n.md"))
-	assert.NoError(t, err, "the raw source is kept")
-
-	require.NoError(t, os.Remove(filepath.Join(raw, "rejected")))
-	_, err = api.RejectNote(brain, api.RejectOptions{Filename: "2026-10-05-n.md"})
-	require.NoError(t, err, "positive control: reject into a real raw/rejected")
-}
@@ -1,75 +0,0 @@
-package api
-
-import (
-	"fmt"
-	"path/filepath"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/provenance"
-)
-
-// StampProvenance applies server-owned provenance (hyperguild#145) to note
-// content. See package provenance for the rule; an error means the stamped
-// note would not read back as stamped, and the write must be refused.
-func StampProvenance(content, origin, writtenBy string) (string, error) {
-	return provenance.Apply(content, provenance.Stamp{Origin: origin, WrittenBy: writtenBy})
-}
-
-// StampProvenanceFile applies StampProvenance to a brain-relative note path,
-// read and rewritten through the brain root (hyperguild#158).
-func StampProvenanceFile(brainDir, relPath, origin, writtenBy string) error {
-	rel, _, err := resolveWithin(brainDir, relPath)
-	if err != nil {
-		return err
-	}
-	bfs, err := brainfs.Open(brainDir)
-	if err != nil {
-		return fmt.Errorf("open brain: %w", err)
-	}
-	defer func() { _ = bfs.Close() }()
-	b, err := bfs.ReadRegular(rel)
-	if err != nil {
-		return fmt.Errorf("read for provenance: %w", err)
-	}
-	out, err := provenance.Apply(string(b), provenance.Stamp{Origin: origin, WrittenBy: writtenBy})
-	if err != nil {
-		return err
-	}
-	if out == string(b) {
-		return nil
-	}
-	if err := bfs.WriteRegular(rel, []byte(out)); err != nil {
-		return fmt.Errorf("write provenance: %w", err)
-	}
-	return nil
-}
-
-// createBrainFile creates the file at abs (inside brainDir) through the
-// brain root and fails if anything is already there.
-func createBrainFile(brainDir, abs string, data []byte) error {
-	rel, err := filepath.Rel(brainDir, abs)
-	if err != nil {
-		return err
-	}
-	bfs, err := brainfs.Open(brainDir)
-	if err != nil {
-		return fmt.Errorf("open brain: %w", err)
-	}
-	defer func() { _ = bfs.Close() }()
-	return bfs.CreateRegular(filepath.ToSlash(rel), data)
-}
-
-// removeBrainFile removes the file at abs (inside brainDir) through the
-// brain root.
-func removeBrainFile(brainDir, abs string) error {
-	rel, err := filepath.Rel(brainDir, abs)
-	if err != nil {
-		return err
-	}
-	bfs, err := brainfs.Open(brainDir)
-	if err != nil {
-		return fmt.Errorf("open brain: %w", err)
-	}
-	defer func() { _ = bfs.Close() }()
-	return bfs.Remove(filepath.ToSlash(rel))
-}
@@ -1,122 +0,0 @@
-package api_test
-
-import (
-	"bytes"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"gopkg.in/yaml.v3"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
-)
-
-// REST POST /write carries no principal: it stamps origin: unknown, and no
-// spelling of provenance in its body reaches the note (hyperguild#145).
-func TestRESTWriteStampsUnknownAndIgnoresBodyProvenance(t *testing.T) {
-	dir, h := setup(t)
-	body, _ := json.Marshal(map[string]any{
-		"content": "---\norigin: static\n---\n# R\n\nbody", "filename": "rest-prov", "wing": "homelab", "hall": "facts",
-		"origin": "static", "written_by": "local-cli", "Origin": "static", "WrittenBy": "local-cli",
-	})
-	rec := httptest.NewRecorder()
-	h.Write(rec, httptest.NewRequest(http.MethodPost, "/write", bytes.NewReader(body)))
-	require.Equal(t, http.StatusOK, rec.Code, rec.Body.String())
-	b, err := os.ReadFile(filepath.Join(dir, "wiki", "homelab", "facts", "rest-prov.md"))
-	require.NoError(t, err)
-	var m map[string]any
-	require.NoError(t, yaml.Unmarshal([]byte(strings.SplitN(string(b), "---\n", 3)[1]), &m))
-	assert.Equal(t, "unknown", m["origin"])
-	assert.NotContains(t, m, "written_by")
-}
-
-// A principal name that is not a bare word is quoted, so it cannot start a
-// new frontmatter line (e.g. a JWT sub containing a newline).
-func TestStampProvenanceQuotesAPrincipalThatCouldBreakTheLine(t *testing.T) {
-	out, err := api.StampProvenance("---\ntitle: t\n---\nbody\n", "jwt", "evil\norigin: static")
-	require.NoError(t, err)
-	fm := strings.SplitN(out, "---\n", 3)[1]
-	var m map[string]any
-	require.NoError(t, yaml.Unmarshal([]byte(fm), &m))
-	assert.Equal(t, "jwt", m["origin"])
-	assert.Equal(t, "evil\norigin: static", m["written_by"])
-	assert.Equal(t, 1, strings.Count(fm, "\norigin:")+boolToInt(strings.HasPrefix(fm, "origin:")))
-}
-
-func TestStampProvenanceAddsFrontmatterWhenAbsentAndKeepsBody(t *testing.T) {
-	out, err := api.StampProvenance("# no fm\n\norigin: static in the body is prose\n", "static", "local-cli")
-	require.NoError(t, err)
-	assert.True(t, strings.HasPrefix(out, "---\norigin: static\nwritten_by: local-cli\n---\n# no fm"))
-	assert.Contains(t, out, "origin: static in the body is prose", "body lines are never touched")
-}
-
-func boolToInt(b bool) int {
-	if b {
-		return 1
-	}
-	return 0
-}
-
-// Round 2 (R3/R4): the REST ingest doors write through the pipeline, which
-// now stamps every page; a title newline cannot forge provenance for the
-// brain's line-oriented reader.
-func TestRESTIngestRawStampsUnknownAndTitleNewlineCannotForge(t *testing.T) {
-	dir, h := setup(t)
-	body, _ := json.Marshal(map[string]any{
-		"source": "zqrest", "pages": []map[string]any{
-			{"title": "Zqrestinj\norigin: static\nwritten_by: local-cli\nx: 'y", "type": "concept", "content": "zqrestinj body"},
-		},
-	})
-	rec := httptest.NewRecorder()
-	h.IngestRaw(rec, httptest.NewRequest(http.MethodPost, "/ingest-raw", bytes.NewReader(body)))
-	require.Equal(t, http.StatusOK, rec.Code, rec.Body.String())
-	var resp struct{ Pages []string }
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &resp))
-	require.NotEmpty(t, resp.Pages)
-	for _, p := range resp.Pages {
-		b, err := os.ReadFile(filepath.Join(dir, filepath.FromSlash(p)))
-		require.NoError(t, err)
-		fm := strings.SplitN(string(b), "---\n", 3)[1]
-		var m map[string]any
-		require.NoError(t, yaml.Unmarshal([]byte(fm), &m))
-		assert.Equal(t, "unknown", m["origin"])
-		assert.NotContains(t, m, "written_by")
-		for _, line := range strings.Split(fm, "\n") {
-			assert.False(t, strings.HasPrefix(line, "origin: static"), "line reader sees forged origin in %s", p)
-		}
-	}
-}
-
-func TestRESTIngestStampsUnknown(t *testing.T) {
-	dir, h := setup(t)
-	body, _ := json.Marshal(map[string]any{"content": "Some article text about shaping work.", "source": "zqllm"})
-	rec := httptest.NewRecorder()
-	h.Ingest(rec, httptest.NewRequest(http.MethodPost, "/ingest", bytes.NewReader(body)))
-	require.Equal(t, http.StatusOK, rec.Code, rec.Body.String())
-	var resp struct{ Pages []string }
-	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &resp))
-	require.NotEmpty(t, resp.Pages, "stub pipeline must write at least one page")
-	for _, p := range resp.Pages {
-		b, err := os.ReadFile(filepath.Join(dir, filepath.FromSlash(p)))
-		require.NoError(t, err)
-		assert.Contains(t, strings.SplitN(string(b), "---\n", 3)[1], "origin: unknown\n", p)
-	}
-}
-
-// A refused write leaves nothing behind, not even an empty hall directory
-// (brain#21's invariant, round 3 non-blocking finding).
-func TestWriteNoteRefusedForProvenanceLeavesNoDirectory(t *testing.T) {
-	dir := t.TempDir()
-	_, err := api.WriteNote(dir, api.WriteNoteOptions{
-		Content: "# x\n\nbody", Wing: "freshwing", Hall: "facts", Filename: "x", Origin: "jwt", WrittenBy: "bad\xff",
-	})
-	require.Error(t, err)
-	_, statErr := os.Stat(filepath.Join(dir, "wiki", "freshwing"))
-	assert.True(t, os.IsNotExist(statErr), "no wing directory may be created by a refused write")
-}
@@ -1,178 +0,0 @@
-package api_test
-
-import (
-	"encoding/base64"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"syscall"
-	"testing"
-	"time"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
-)
-
-// hyperguild#153 / PR #156: behavioural race tests, so the control does not
-// rest on lints that list forbidden APIs (round 3: an os.ReadFile or
-// Root.ReadFile rewrite passed the lint and leaked 19k times in 4s). A
-// swapper keeps renaming a regular note, a symlink to an outside file, or a
-// FIFO into raw/r.md while the public readers loop. Any leaked byte fails;
-// any hang fails.
-
-const raceSentinel = "SENTINEL-153-RACE"
-
-// startSwapper runs fn until the test ends, and waits for it to exit before
-// t.TempDir's cleanup removes the directory it writes into (hyperguild#162:
-// an unawaited swapper raced the cleanup, "directory not empty").
-func startSwapper(t *testing.T, fn func(stop *atomic.Bool)) {
-	t.Helper()
-	var stop atomic.Bool
-	var wg sync.WaitGroup
-	wg.Add(1)
-	go func() { defer wg.Done(); fn(&stop) }()
-	t.Cleanup(func() { stop.Store(true); wg.Wait() })
-}
-
-func swap(raw, outside string, fifo bool, stop *atomic.Bool) {
-	tgt := filepath.Join(raw, "r.md")
-	for i := 0; !stop.Load(); i++ {
-		tmp := filepath.Join(raw, ".swap")
-		_ = os.Remove(tmp)
-		switch {
-		case i%2 == 0:
-			_ = os.WriteFile(tmp, []byte("# r\n\ninside"), 0o644)
-		case fifo:
-			_ = syscall.Mkfifo(tmp, 0o644)
-		default:
-			_ = os.Symlink(outside, tmp)
-		}
-		_ = os.Rename(tmp, tgt)
-	}
-}
-
-func raceBrain(t *testing.T) (brain, raw, outside string) {
-	t.Helper()
-	brain = t.TempDir()
-	raw = filepath.Join(brain, "raw")
-	if err := os.MkdirAll(raw, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	outside = filepath.Join(t.TempDir(), "secret.md")
-	if err := os.WriteFile(outside, []byte("# s\n\n"+raceSentinel), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(raw, "r.md"), []byte("# r\n\ninside"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	return brain, raw, outside
-}
-
-// readers runs every public raw/ reader once and returns all text they
-// produced (excerpts, extracted text).
-func readers(brain, raw string) string {
-	var b strings.Builder
-	if ns, err := api.ListPending(brain); err == nil {
-		for _, n := range ns {
-			b.WriteString(n.Excerpt)
-		}
-	}
-	if s, err := api.ReadIngestFile(brain, filepath.Join(raw, "r.md")); err == nil {
-		b.WriteString(s)
-	}
-	return b.String()
-}
-
-func TestRawReadersLeakNothingUnderASymlinkSwapRace(t *testing.T) {
-	brain, raw, outside := raceBrain(t)
-	startSwapper(t, func(stop *atomic.Bool) { swap(raw, outside, false, stop) })
-	leaks, iters := 0, 0
-	for deadline := time.Now().Add(1500 * time.Millisecond); time.Now().Before(deadline); iters++ {
-		leaks += strings.Count(readers(brain, raw), raceSentinel)
-	}
-	if leaks > 0 {
-		t.Fatalf("outside file leaked %d times in %d iterations", leaks, iters)
-	}
-	t.Logf("%d iterations, 0 leaks", iters)
-}
-
-func TestRawReadersDoNotHangUnderAFIFOSwapRace(t *testing.T) {
-	brain, raw, outside := raceBrain(t)
-	startSwapper(t, func(stop *atomic.Bool) { swap(raw, outside, true, stop) })
-	var iters atomic.Int64
-	done := make(chan struct{})
-	go func() {
-		for deadline := time.Now().Add(1500 * time.Millisecond); time.Now().Before(deadline); {
-			_ = readers(brain, raw)
-			iters.Add(1)
-		}
-		close(done)
-	}()
-	select {
-	case <-done:
-	case <-time.After(6 * time.Second):
-		// Unblock the stuck open so the test process can exit.
-		if f, err := os.OpenFile(filepath.Join(raw, "r.md"), os.O_WRONLY|syscall.O_NONBLOCK, 0); err == nil {
-			_ = f.Close()
-		}
-		t.Fatalf("a raw/ reader hung on a swapped-in FIFO after %d iterations", iters.Load())
-	}
-}
-
-// PR #156 round 4: the pdf/docmark branch of TextIn copies the file through
-// the root to a temp file; pointing the extractor back at the raw/ path by
-// name stayed green because the race tests only used r.md (a stub docmark
-// then received the outside file's bytes 34k times in 4s). This races a
-// symlink into raw/r.docx and has a fake docmark count the sentinel in every
-// document it is sent.
-func TestDocmarkExtractionLeaksNothingUnderASymlinkSwapRace(t *testing.T) {
-	var seen atomic.Int64
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		var req struct {
-			Params struct {
-				Arguments struct {
-					ContentBase64 string `json:"content_base64"`
-				} `json:"arguments"`
-			} `json:"params"`
-		}
-		_ = json.NewDecoder(r.Body).Decode(&req)
-		if b, err := base64.StdEncoding.DecodeString(req.Params.Arguments.ContentBase64); err == nil &&
-			strings.Contains(string(b), raceSentinel) {
-			seen.Add(1)
-		}
-		w.Header().Set("Content-Type", "application/json")
-		_, _ = w.Write([]byte(`{"jsonrpc":"2.0","id":1,"result":{"content":[{"type":"text","text":"converted"}]}}`))
-	}))
-	defer srv.Close()
-	t.Setenv("DOCMARK_URL", srv.URL)
-
-	brain, raw, outside := raceBrain(t)
-	tgt := filepath.Join(raw, "r.docx")
-	if err := os.WriteFile(tgt, []byte("inside docx bytes"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	startSwapper(t, func(stop *atomic.Bool) {
-		for i := 0; !stop.Load(); i++ {
-			tmp := filepath.Join(raw, ".swapdocx")
-			_ = os.Remove(tmp)
-			if i%2 == 0 {
-				_ = os.WriteFile(tmp, []byte("inside docx bytes"), 0o644)
-			} else {
-				_ = os.Symlink(outside, tmp)
-			}
-			_ = os.Rename(tmp, tgt)
-		}
-	})
-	iters := 0
-	for deadline := time.Now().Add(1500 * time.Millisecond); time.Now().Before(deadline); iters++ {
-		_, _ = api.ReadIngestFile(brain, tgt)
-	}
-	if n := seen.Load(); n > 0 {
-		t.Fatalf("docmark received the outside file %d times in %d iterations", n, iters)
-	}
-	t.Logf("%d iterations, 0 leaks to docmark", iters)
-}
@@ -1,80 +0,0 @@
-package api_test
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
-)
-
-// hyperguild#153: readers of brain/raw/ followed symlinks. /pending showed the
-// target's contents and promote would copy it into wiki/ (and brain-sync to
-// Gitea). raw/ is writable via Syncthing, so a symlink there is reachable
-// input. Every raw/ reader now treats a symlink as not-a-note.
-const sentinel153 = "SENTINEL-153-OUTSIDE"
-
-func rawWithSymlink(t *testing.T) (brain string) {
-	t.Helper()
-	brain = t.TempDir()
-	raw := filepath.Join(brain, "raw")
-	require.NoError(t, os.MkdirAll(raw, 0o755))
-	outside := filepath.Join(t.TempDir(), "secret.md")
-	require.NoError(t, os.WriteFile(outside, []byte("---\ncreated_at: 2026-01-01T00:00:00Z\n---\n# s\n\n"+sentinel153), 0o644))
-	require.NoError(t, os.Symlink(outside, filepath.Join(raw, "2026-01-01-leak.md")))
-	require.NoError(t, os.WriteFile(filepath.Join(raw, "2026-01-02-real.md"), []byte("# real\n\nreal body"), 0o644))
-	return brain
-}
-
-func TestListPendingSkipsSymlinkedNotes(t *testing.T) {
-	notes, err := api.ListPending(rawWithSymlink(t))
-	require.NoError(t, err)
-	var names []string
-	for _, n := range notes {
-		names = append(names, n.Filename)
-		assert.NotContains(t, n.Excerpt, sentinel153)
-	}
-	assert.Equal(t, []string{"2026-01-02-real.md"}, names)
-}
-
-func TestPromoteNoteRefusesASymlinkedSource(t *testing.T) {
-	brain := rawWithSymlink(t)
-	_, err := api.PromoteNote(brain, api.PromoteOptions{Filename: "2026-01-01-leak.md", Wing: "testing", Hall: "facts"})
-	require.Error(t, err)
-	_, statErr := os.Stat(filepath.Join(brain, "wiki", "testing", "facts", "leak.md"))
-	assert.True(t, os.IsNotExist(statErr), "nothing may be promoted from a symlink")
-}
-
-func TestRejectNoteRefusesASymlinkedSource(t *testing.T) {
-	brain := rawWithSymlink(t)
-	_, err := api.RejectNote(brain, api.RejectOptions{Filename: "2026-01-01-leak.md"})
-	require.Error(t, err)
-	b, _ := os.ReadFile(filepath.Join(brain, "raw", "rejected", "2026-01-01-leak.md"))
-	assert.False(t, strings.Contains(string(b), sentinel153))
-}
-
-// Item 4: if raw/ itself is a symlink, containment inside it means nothing.
-func TestResolvePendingPromoteRejectAndReadIngestRefuseASymlinkedRawRoot(t *testing.T) {
-	brain := t.TempDir()
-	elsewhere := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(elsewhere, "x.md"), []byte("# x\n\n"+sentinel153), 0o644))
-	require.NoError(t, os.Symlink(elsewhere, filepath.Join(brain, "raw")))
-
-	_, err := api.ResolveIngestPath(brain, "x.md")
-	assert.Error(t, err, "ingest must refuse a symlinked raw/")
-	notes, err := api.ListPending(brain)
-	assert.Error(t, err, "pending must refuse a symlinked raw/")
-	assert.Empty(t, notes)
-	_, err = api.PromoteNote(brain, api.PromoteOptions{Filename: "x.md", Wing: "testing", Hall: "facts"})
-	assert.Error(t, err, "promote must refuse a symlinked raw/")
-	_, err = api.RejectNote(brain, api.RejectOptions{Filename: "x.md"})
-	assert.Error(t, err, "reject must refuse a symlinked raw/")
-	text, err := api.ReadIngestFile(brain, filepath.Join(elsewhere, "x.md"))
-	assert.Error(t, err, "ReadIngestFile must refuse a symlinked raw/")
-	assert.NotContains(t, text, sentinel153)
-	// The watcher's refusal is tested in internal/watcher.
-}
@@ -1,67 +0,0 @@
-package api
-
-import (
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/extract"
-)
-
-// errNotANote is returned for a raw/ entry that is not a regular file — in
-// particular a symlink, whose target may be anywhere (hyperguild#153).
-var errNotANote = errors.New("not a regular note file in raw/ (symlinks are refused)")
-
-// errRawNotDir means brain/raw is not a real directory (e.g. a symlink), so
-// containment inside it would mean nothing (hyperguild#153 item 4).
-var errRawNotDir = errors.New("brain/raw is not a real directory")
-
-// OpenRawRoot opens brain/raw as an os.Root, refusing a raw/ that is itself a
-// symlink. Reads through the root cannot leave it, even if an entry is
-// swapped for a symlink between a check and the read. It returns the root
-// and raw/'s path. A missing raw/ returns an error wrapping os.ErrNotExist.
-func OpenRawRoot(brainDir string) (*os.Root, string, error) {
-	p := filepath.Join(brainDir, "raw")
-	fi, err := os.Lstat(p)
-	if err != nil {
-		return nil, "", err
-	}
-	if fi.Mode()&os.ModeSymlink != 0 || !fi.IsDir() {
-		return nil, "", errRawNotDir
-	}
-	r, err := os.OpenRoot(p)
-	if err != nil {
-		return nil, "", fmt.Errorf("open raw root: %w", err)
-	}
-	return r, p, nil
-}
-
-// readRawNote reads one raw/ entry by basename through the root, refusing
-// anything that is not a regular file.
-//
-// Accepted residual: a HARD link to an outside file is a regular file and is
-// read. Syncthing syncs contents, not links, so a peer cannot create one;
-// fs.protected_hardlinks=1 and the pod's secrets live on a different
-// filesystem from the brain volume, so a local caller cannot link them in.
-// Refusing Nlink > 1 is the next step if either assumption changes.
-func readRawNote(r *os.Root, base string) ([]byte, os.FileInfo, error) {
-	fi, err := r.Lstat(base)
-	if err != nil {
-		return nil, nil, err
-	}
-	if !fi.Mode().IsRegular() {
-		return nil, nil, errNotANote
-	}
-	f, _, err := extract.OpenRegular(r, base)
-	if err != nil {
-		return nil, nil, err
-	}
-	defer func() { _ = f.Close() }()
-	b, err := io.ReadAll(f)
-	if err != nil {
-		return nil, nil, err
-	}
-	return b, fi, nil
-}
@@ -1,52 +0,0 @@
-package api_test
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs/brainfstest"
-)
-
-// hyperguild#157 slice 2: ReadNote (brain_get, read-after-write) read by
-// path; it now reads through brainfs.
-func TestReadNoteRefusesSymlinksAndSurvivesSwapRaces(t *testing.T) {
-	brain := t.TempDir()
-	facts := filepath.Join(brain, "wiki", "w", "facts")
-	require.NoError(t, os.MkdirAll(facts, 0o755))
-	require.NoError(t, os.Symlink(brainfstest.Outside(t), filepath.Join(facts, "leak.md")))
-	_, body, _, err := api.ReadNote(brain, "wiki/w/facts/leak.md")
-	assert.Error(t, err)
-	assert.NotContains(t, body, brainfstest.Sentinel)
-	// A link to a file elsewhere in the brain: os.Root allows it, only the
-	// regular-file check refuses it (hyperguild#171).
-	brainfstest.WriteSentinelAt(t, filepath.Join(brain, "raw", "s.md"))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "..", "raw", "s.md"), filepath.Join(facts, "inlink.md")))
-	_, body, _, err = api.ReadNote(brain, "wiki/w/facts/inlink.md")
-	assert.Error(t, err)
-	assert.NotContains(t, body, brainfstest.Sentinel)
-
-	p := filepath.Join(facts, "r.md")
-	require.NoError(t, os.WriteFile(p, []byte("---\nx: y\n---\ninside"), 0o644))
-	fm, body, _, err := api.ReadNote(brain, "wiki/w/facts/r.md")
-	require.NoError(t, err)
-	assert.Equal(t, "y", fm["x"])
-	assert.Contains(t, body, "inside")
-	read := func() string {
-		fm, body, _, _ := api.ReadNote(brain, "wiki/w/facts/r.md")
-		s := body
-		for k, v := range fm {
-			s += k + v
-		}
-		return s
-	}
-	brainfstest.AssertNoLeak(t, p, "---\nx: y\n---\ninside", 1500*time.Millisecond, read)
-	inBrain := brainfstest.WriteSentinelAt(t, filepath.Join(brain, "raw", "s.md"))
-	brainfstest.AssertNoLeakFrom(t, p, "---\nx: y\n---\ninside", inBrain, 1500*time.Millisecond, read)
-	brainfstest.AssertNoHang(t, p, "---\nx: y\n---\ninside", 1500*time.Millisecond, 6*time.Second, func() { _ = read() })
-}
@@ -3,18 +3,14 @@ package api
 import (
 	"crypto/sha256"
 	"encoding/hex"
-	"errors"
 	"fmt"
-	"io/fs"
 	"os"
 	"path/filepath"
 	"strings"
 	"time"

 	"github.com/mathiasbq/hyperguild/ingestion/internal/brain"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/claim"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/notes"
 )

 // ContentHash returns the lowercase hex sha256 of b. It is the note's
@@ -50,11 +46,6 @@ type UpdateNoteOptions struct {
 	Slug    string
 	Content string // new full body (whole-note replace)
 	Reason  string // optional; stamped as supersede_reason
-	// Origin/WrittenBy re-stamp provenance to the updating principal: the
-	// body is replaced wholesale, so the last writer is the author of what
-	// a reader sees (hyperguild#145). Never taken from Content's fragment.
-	Origin    string
-	WrittenBy string
 }

 // UpdateNote supersedes an existing note in place. It replaces the body
@@ -94,23 +85,14 @@ func UpdateNote(brainDir string, opts UpdateNoteOptions) (relPath, contentHash,
 		rel = filepath.ToSlash(rel)
 	}

-	// The path is caller-supplied (brain_update): resolve it as brain_edit
-	// does, knowledge/ and wiki/ notes only, and read and rewrite it through
-	// the brain root, never through a symlink (hyperguild#169).
-	t, err := notes.Resolve(brainDir, rel, notes.ScopeNotes)
+	rel, abs, err := resolveWithin(brainDir, rel)
 	if err != nil {
 		return "", "", "", err
 	}
-	rel = t.Rel
-	bfs, err := brainfs.Open(brainDir)
-	if err != nil {
-		return "", "", "", fmt.Errorf("open brain: %w", err)
-	}
-	defer func() { _ = bfs.Close() }()

-	prior, err := bfs.ReadRegular(rel)
+	prior, err := os.ReadFile(abs)
 	if err != nil {
-		if errors.Is(err, fs.ErrNotExist) {
+		if os.IsNotExist(err) {
 			return "", "", "", fmt.Errorf("note %q does not exist: use brain_write to create", rel)
 		}
 		return "", "", "", fmt.Errorf("read target: %w", err)
@@ -128,23 +110,9 @@ func UpdateNote(brainDir string, opts UpdateNoteOptions) (relPath, contentHash,

 	fm, _ := parseFrontmatter(string(prior))
 	for _, l := range contentFM.lines {
-		// updated_at/supersedes/supersede_reason are this function's own
-		// output, not something a caller's fragment sets — updated_at and
-		// supersedes are already unconditionally re-set below regardless of
-		// what the loop does with them, but supersede_reason is only
-		// re-set when opts.Reason is non-empty, so without this skip a
-		// caller could set it via its own fragment and have it survive
-		// even when Reason is empty, bypassing the one intended entry
-		// point for that field (hyperguild#125, found in #111's review).
-		// Skipping all three here rather than relying on the unconditional
-		// overwrites below to save the other two keeps the invariant
-		// explicit at the one place it can be silently broken by a future
-		// reordering, not implicit in call order.
-		if l.key == "" || l.key == "updated_at" || l.key == "supersedes" || l.key == "supersede_reason" ||
-			l.key == "origin" || l.key == "written_by" {
-			continue
+		if l.key != "" {
+			fm.set(l.key, l.value)
 		}
-		fm.set(l.key, l.value)
 	}
 	fm.set("updated_at", time.Now().UTC().Format(time.RFC3339))
 	fm.set("supersedes", priorHash)
@@ -171,12 +139,8 @@ func UpdateNote(brainDir string, opts UpdateNoteOptions) (relPath, contentHash,
 		return "", "", "", fmt.Errorf("claim envelope: %w", err)
 	}

-	stamped, err := StampProvenance(fm.render()+contentBody, opts.Origin, opts.WrittenBy)
-	if err != nil {
-		return "", "", "", err
-	}
-	out := []byte(stamped)
-	if err := bfs.WriteRegular(rel, out); err != nil {
+	out := []byte(fm.render() + contentBody)
+	if err := os.WriteFile(abs, out, 0o644); err != nil {
 		return "", "", "", fmt.Errorf("write: %w", err)
 	}
 	return rel, ContentHash(out), priorHash, nil
@@ -187,17 +151,11 @@ func UpdateNote(brainDir string, opts UpdateNoteOptions) (relPath, contentHash,
 // write primitive behind brain_get: the hash it returns equals the hash
 // brain_write / brain_update returned for the same bytes.
 func ReadNote(brainDir, relPath string) (fm map[string]string, body, contentHash string, err error) {
-	rel, _, err := resolveWithin(brainDir, relPath)
+	_, abs, err := resolveWithin(brainDir, relPath)
 	if err != nil {
 		return nil, "", "", err
 	}
-	// Through the brain root, regular files only (hyperguild#157).
-	bfs, err := brainfs.Open(brainDir)
-	if err != nil {
-		return nil, "", "", fmt.Errorf("read note: %w", err)
-	}
-	defer func() { _ = bfs.Close() }()
-	raw, err := bfs.ReadRegular(rel)
+	raw, err := os.ReadFile(abs)
 	if err != nil {
 		if os.IsNotExist(err) {
 			return nil, "", "", fmt.Errorf("note %q does not exist", relPath)
@@ -1,36 +0,0 @@
-package api_test
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
-)
-
-// hyperguild#173: a directory symlink inside wiki/ that points elsewhere in
-// the brain redirected brain_update's write (os.Root follows in-root
-// intermediate symlinks). Every directory above the note must be real.
-func TestUpdateNoteRefusesANoteBehindASymlinkedDirectory(t *testing.T) {
-	brain := t.TempDir()
-	victim := filepath.Join(brain, "raw", "facts", "v.md")
-	require.NoError(t, os.MkdirAll(filepath.Dir(victim), 0o755))
-	require.NoError(t, os.WriteFile(victim, []byte("---\ntitle: v\n---\nuntouched\n"), 0o644))
-	require.NoError(t, os.MkdirAll(filepath.Join(brain, "wiki", "w"), 0o755))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "raw", "facts"), filepath.Join(brain, "wiki", "w", "alias")))
-
-	_, _, _, err := api.UpdateNote(brain, api.UpdateNoteOptions{Path: "wiki/w/alias/v.md", Content: "replaced"})
-	assert.ErrorIs(t, err, brainfs.ErrNotRegular)
-	got, _ := os.ReadFile(victim)
-	assert.Contains(t, string(got), "untouched")
-
-	real := filepath.Join(brain, "wiki", "w", "facts", "r.md")
-	require.NoError(t, os.MkdirAll(filepath.Dir(real), 0o755))
-	require.NoError(t, os.WriteFile(real, []byte("---\ntitle: r\n---\nold\n"), 0o644))
-	_, _, _, err = api.UpdateNote(brain, api.UpdateNoteOptions{Path: "wiki/w/facts/r.md", Content: "new"})
-	require.NoError(t, err, "positive control: a note in a real directory is updated")
-}
@@ -1,112 +0,0 @@
-package api_test
-
-import (
-	"os"
-	"path/filepath"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
-)
-
-// brain_update passed the caller's path through resolveWithin, a lexical
-// containment check only: any file in the brain could be superseded
-// (classification.yaml, raw/, sessions/), and a final symlink was written
-// through. It now resolves like brain_edit: knowledge/ and wiki/ notes only,
-// read and rewritten through the brain root.
-func TestUpdateNoteRefusesPathsOutsideKnowledgeAndWikiNotes(t *testing.T) {
-	brain := t.TempDir()
-	files := map[string]string{
-		"classification.yaml": "levels: {}\n",
-		"raw/r.md":            "raw\n",
-		"sessions/s.jsonl":    "{}\n",
-		"wiki/w/facts/ok.md":  "---\ntitle: ok\n---\nold\n",
-		"knowledge/k.md":      "---\ntitle: k\n---\nold\n",
-		"wiki/w/facts/x.txt":  "txt\n",
-	}
-	for rel, body := range files {
-		p := filepath.Join(brain, filepath.FromSlash(rel))
-		require.NoError(t, os.MkdirAll(filepath.Dir(p), 0o755))
-		require.NoError(t, os.WriteFile(p, []byte(body), 0o644))
-	}
-	for _, rel := range []string{"classification.yaml", "raw/r.md", "sessions/s.jsonl", "wiki/w/facts/x.txt", "wiki/w/../../raw/r.md"} {
-		_, _, _, err := api.UpdateNote(brain, api.UpdateNoteOptions{Path: rel, Content: "replaced"})
-		assert.Error(t, err, rel)
-	}
-	for rel, body := range files {
-		if rel == "wiki/w/facts/ok.md" || rel == "knowledge/k.md" {
-			continue
-		}
-		got, err := os.ReadFile(filepath.Join(brain, filepath.FromSlash(rel)))
-		require.NoError(t, err)
-		assert.Equal(t, body, string(got), rel)
-	}
-	for _, rel := range []string{"wiki/w/facts/ok.md", "knowledge/k.md"} {
-		_, _, _, err := api.UpdateNote(brain, api.UpdateNoteOptions{Path: rel, Content: "new body"})
-		require.NoError(t, err, "positive control: %s", rel)
-		got, _ := os.ReadFile(filepath.Join(brain, filepath.FromSlash(rel)))
-		assert.Contains(t, string(got), "new body")
-	}
-}
-
-func TestUpdateNoteDoesNotWriteThroughASymlinkedNote(t *testing.T) {
-	brain := t.TempDir()
-	facts := filepath.Join(brain, "wiki", "w", "facts")
-	require.NoError(t, os.MkdirAll(facts, 0o755))
-	victim := filepath.Join(brain, "raw", "victim.md")
-	require.NoError(t, os.MkdirAll(filepath.Dir(victim), 0o755))
-	require.NoError(t, os.WriteFile(victim, []byte("untouched\n"), 0o644))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "..", "raw", "victim.md"), filepath.Join(facts, "l.md")))
-	_, _, _, err := api.UpdateNote(brain, api.UpdateNoteOptions{Path: "wiki/w/facts/l.md", Content: "replaced"})
-	assert.Error(t, err)
-	got, _ := os.ReadFile(victim)
-	assert.Equal(t, "untouched\n", string(got))
-}
-
-// The note is swapped between a regular file and an in-brain symlink to a
-// raw/ file while UpdateNote runs: the read and the write each refuse a
-// symlink, so the raw/ file is never rewritten.
-func TestUpdateNoteNeverRewritesASymlinkSwappedInForTheNote(t *testing.T) {
-	brain := t.TempDir()
-	facts := filepath.Join(brain, "wiki", "w", "facts")
-	require.NoError(t, os.MkdirAll(facts, 0o755))
-	victim := filepath.Join(brain, "raw", "victim.md")
-	require.NoError(t, os.MkdirAll(filepath.Dir(victim), 0o755))
-	require.NoError(t, os.WriteFile(victim, []byte("untouched\n"), 0o644))
-	note := filepath.Join(facts, "n.md")
-	body := "---\ntitle: n\n---\nold\n"
-	require.NoError(t, os.WriteFile(note, []byte(body), 0o644))
-
-	var stop atomic.Bool
-	var wg sync.WaitGroup
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		tmp := note + ".swap"
-		for i := 0; !stop.Load(); i++ {
-			_ = os.Remove(tmp)
-			if i%2 == 0 {
-				_ = os.WriteFile(tmp, []byte(body), 0o644)
-			} else {
-				_ = os.Symlink(filepath.Join("..", "..", "..", "raw", "victim.md"), tmp)
-			}
-			_ = os.Rename(tmp, note)
-		}
-	}()
-	ok := 0
-	for deadline := time.Now().Add(1500 * time.Millisecond); time.Now().Before(deadline); {
-		if _, _, _, err := api.UpdateNote(brain, api.UpdateNoteOptions{Path: "wiki/w/facts/n.md", Content: "new"}); err == nil {
-			ok++
-		}
-	}
-	stop.Store(true)
-	wg.Wait()
-	got, _ := os.ReadFile(victim)
-	assert.Equal(t, "untouched\n", string(got))
-	assert.Positive(t, ok, "positive control: some updates reach the regular note")
-}
@@ -231,45 +231,6 @@ func TestUpdateThenReadRoundTripsHash(t *testing.T) {
 	assert.Equal(t, hash, readHash, "update content_hash must round-trip through ReadNote")
 }

-func TestUpdateNoteSupersedeReasonNotSettableViaCallerFragmentWhenReasonOptionEmpty(t *testing.T) {
-	// hyperguild#125, found in #111's review: the merge loop applied every
-	// field from the caller's leading frontmatter fragment, including
-	// supersede_reason -- which is only re-set unconditionally when
-	// opts.Reason is non-empty, so a caller could set it via its own
-	// fragment and have it survive even with Reason left empty, bypassing
-	// the one intended entry point for that field.
-	brainDir := t.TempDir()
-	rel := seedNote(t, brainDir, "wiki/a/facts/n.md", "---\nwing: a\nhall: facts\n---\nold\n")
-
-	_, _, _, err := UpdateNote(brainDir, UpdateNoteOptions{
-		Path:    rel,
-		Content: "---\nsupersede_reason: snuck in via the fragment\n---\nnew\n",
-		// Reason deliberately left empty.
-	})
-	require.NoError(t, err)
-
-	got, err := os.ReadFile(filepath.Join(brainDir, filepath.FromSlash(rel)))
-	require.NoError(t, err)
-	assert.NotContains(t, string(got), "supersede_reason",
-		"supersede_reason must not appear at all when opts.Reason is empty, regardless of what the fragment tried to set")
-}
-
-func TestUpdateNoteSupersedeReasonFromOptionStillWorks(t *testing.T) {
-	// Regression pin: the legitimate entry point (opts.Reason) must be
-	// completely unaffected by #125's fix.
-	brainDir := t.TempDir()
-	rel := seedNote(t, brainDir, "wiki/a/facts/n.md", "---\nwing: a\nhall: facts\n---\nold\n")
-
-	_, _, _, err := UpdateNote(brainDir, UpdateNoteOptions{
-		Path: rel, Content: "new\n", Reason: "facts changed",
-	})
-	require.NoError(t, err)
-
-	got, err := os.ReadFile(filepath.Join(brainDir, filepath.FromSlash(rel)))
-	require.NoError(t, err)
-	assert.Contains(t, string(got), "supersede_reason: facts changed")
-}
-
 func TestContentHashStable(t *testing.T) {
 	assert.Equal(t, ContentHash([]byte("abc")), ContentHash([]byte("abc")))
 	assert.NotEqual(t, ContentHash([]byte("abc")), ContentHash([]byte("abd")))
@@ -1,34 +0,0 @@
-package api_test
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
-)
-
-// hyperguild#178: an unreadable directory under wiki/ made the link check
-// fail and brain_write refuse the note, losing the learning. The note is now
-// written with its links as given.
-func TestWriteNoteKeepsTheLearningWhenTheLinkCheckCannotIndex(t *testing.T) {
-	if os.Geteuid() == 0 {
-		t.Skip("root ignores directory permissions")
-	}
-	brain := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(brain, "wiki", "w", "facts"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(brain, "wiki", "w", "facts", "real.md"), []byte("x"), 0o644))
-	locked := filepath.Join(brain, "wiki", "other", "locked")
-	require.NoError(t, os.MkdirAll(locked, 0o755))
-	require.NoError(t, os.Chmod(locked, 0o000))
-	t.Cleanup(func() { _ = os.Chmod(locked, 0o755) })
-
-	rel, err := api.WriteNote(brain, api.WriteNoteOptions{Wing: "w", Hall: "facts", Filename: "n", Content: "learning [[real]] and [[gone]]"})
-	require.NoError(t, err)
-	got, err := os.ReadFile(filepath.Join(brain, filepath.FromSlash(rel)))
-	require.NoError(t, err)
-	assert.Contains(t, string(got), "[[gone]]", "links kept as given when the index is partial")
-}
@@ -1,43 +0,0 @@
-package api_test
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
-)
-
-// hyperguild#188: brain_write created a new note with os.MkdirAll +
-// os.WriteFile by path, so a symlinked wing directory redirected the note
-// elsewhere in the brain or outside it.
-func TestWriteNoteRefusesASymlinkedWing(t *testing.T) {
-	for name, target := range map[string]func(t *testing.T, brain string) string{
-		"in-brain": func(t *testing.T, brain string) string {
-			require.NoError(t, os.MkdirAll(filepath.Join(brain, "raw"), 0o755))
-			return filepath.Join("..", "raw")
-		},
-		"outside": func(t *testing.T, _ string) string { return t.TempDir() },
-	} {
-		t.Run(name, func(t *testing.T) {
-			brain := t.TempDir()
-			require.NoError(t, os.MkdirAll(filepath.Join(brain, "wiki"), 0o755))
-			link := target(t, brain)
-			require.NoError(t, os.Symlink(link, filepath.Join(brain, "wiki", "lw")))
-			_, err := api.WriteNote(brain, api.WriteNoteOptions{Wing: "lw", Hall: "facts", Filename: "n", Content: "learning"})
-			assert.Error(t, err)
-			resolved := link
-			if !filepath.IsAbs(resolved) {
-				resolved = filepath.Join(brain, "wiki", link)
-			}
-			_, serr := os.Stat(filepath.Join(resolved, "facts"))
-			assert.True(t, os.IsNotExist(serr), "a hall was created at the link's target")
-
-			_, err = api.WriteNote(brain, api.WriteNoteOptions{Wing: "w", Hall: "facts", Filename: "n", Content: "learning"})
-			require.NoError(t, err, "positive control: a real wing is written")
-		})
-	}
-}
@@ -13,14 +13,9 @@ import (
 type NtfyNotifier struct {
 	topicURL string
 	token    string
-	title    string
 	http     *http.Client
 }

-// defaultNtfyTitle is the title of a notifier built without WithTitle: the
-// capture audit's degraded-state alert, its first user.
-const defaultNtfyTitle = "brain-capture audit degraded"
-
 // NewNtfyNotifier constructs a notifier for the given ntfy topic URL
 // (e.g. https://ntfy.sh/my-topic). token is an optional bearer for
 // protected ntfy instances; it is held here and only sent in the
@@ -32,31 +27,17 @@ func NewNtfyNotifier(topicURL, token string) *NtfyNotifier {
 	return &NtfyNotifier{
 		topicURL: strings.TrimRight(topicURL, "/"),
 		token:    token,
-		title:    defaultNtfyTitle,
 		http:     &http.Client{Timeout: 10 * time.Second},
 	}
 }

-// WithTitle returns a copy that sends title as the ntfy Title header, so each
-// alert source (the capture audit, the symlink tripwire, governance edits)
-// is recognisable on the phone (hyperguild#163). A nil notifier (ntfy not
-// configured) stays nil.
-func (n *NtfyNotifier) WithTitle(title string) *NtfyNotifier {
-	if n == nil {
-		return nil
-	}
-	c := *n
-	c.title = title
-	return &c
-}
-
 // Notify posts a message to the ntfy topic.
 func (n *NtfyNotifier) Notify(ctx context.Context, msg string) error {
 	req, err := http.NewRequestWithContext(ctx, http.MethodPost, n.topicURL, strings.NewReader(msg))
 	if err != nil {
 		return err
 	}
-	req.Header.Set("Title", n.title)
+	req.Header.Set("Title", "brain-capture audit degraded")
 	req.Header.Set("Priority", "high")
 	req.Header.Set("Tags", "warning,brain")
 	if n.token != "" {
@@ -68,19 +49,7 @@ func (n *NtfyNotifier) Notify(ctx context.Context, msg string) error {
 	}
 	defer func() { _ = resp.Body.Close() }()
 	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
-		return &RejectedError{Status: resp.StatusCode}
+		return fmt.Errorf("ntfy notify: status %d", resp.StatusCode)
 	}
 	return nil
 }
-
-// RejectedError is a non-2xx ntfy response.
-type RejectedError struct{ Status int }
-
-func (e *RejectedError) Error() string { return fmt.Sprintf("ntfy notify: status %d", e.Status) }
-
-// Permanent reports whether resending the same message cannot succeed: a 4xx
-// other than 429 (rate limited). Callers may drop such a message; anything
-// else (5xx, 429, transport errors) is an outage and must be retried.
-func (e *RejectedError) Permanent() bool {
-	return e.Status >= 400 && e.Status < 500 && e.Status != http.StatusTooManyRequests
-}
@@ -1,27 +0,0 @@
-package audit
-
-import (
-	"context"
-	"errors"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// A non-2xx ntfy response is a *RejectedError, and only a client-side refusal
-// other than rate limiting is permanent: callers may drop a message on a
-// permanent rejection and must retry the rest (hyperguild#157, PR #160).
-func TestNotifyClassifiesRejectionsAsPermanentOrNot(t *testing.T) {
-	for status, permanent := range map[int]bool{413: true, 400: true, 403: true, 429: false, 500: false, 503: false} {
-		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { w.WriteHeader(status) }))
-		err := NewNtfyNotifier(srv.URL, "").Notify(context.Background(), "m")
-		srv.Close()
-		var rej *RejectedError
-		require.True(t, errors.As(err, &rej), "status %d: %v", status, err)
-		assert.Equal(t, status, rej.Status)
-		assert.Equal(t, permanent, rej.Permanent(), "status %d", status)
-	}
-}
@@ -1,29 +0,0 @@
-package audit
-
-import (
-	"context"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// hyperguild#163: every alert went out titled "brain-capture audit
-// degraded", including the symlink tripwire's and governance alerts.
-func TestNtfyNotifierSendsItsOwnTitle(t *testing.T) {
-	var got []string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		got = append(got, r.Header.Get("Title"))
-	}))
-	defer srv.Close()
-	base := NewNtfyNotifier(srv.URL, "")
-	require.NoError(t, base.Notify(context.Background(), "m"))
-	require.NoError(t, base.WithTitle("brain symlink tripwire").Notify(context.Background(), "m"))
-	require.NoError(t, base.Notify(context.Background(), "m"))
-	assert.Equal(t, []string{"brain-capture audit degraded", "brain symlink tripwire", "brain-capture audit degraded"}, got,
-		"WithTitle returns a copy; the base keeps its default title")
-	var nilN *NtfyNotifier
-	assert.Nil(t, nilN.WithTitle("x"), "nil (ntfy not configured) stays nil")
-}
@@ -1,125 +0,0 @@
-package brain_test
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"syscall"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brain"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs/brainfstest"
-)
-
-// hyperguild#174 / #157 slice 5b: DetectTunnels walked wiki/ and opened
-// every note with a blocking os.Open, so a FIFO named *.md anywhere under
-// wiki/ hung every brain_write and brain_update (wikiUpkeep -> AutoTunnel),
-// and a symlinked note's title became a tunnel candidate.
-func TestDetectTunnelsReturnsPromptlyWithAFIFOUnderWikiWithAndWithoutAWriter(t *testing.T) {
-	for _, withWriter := range []bool{false, true} {
-		t.Run(fmt.Sprintf("writer=%v", withWriter), func(t *testing.T) {
-			b := t.TempDir()
-			facts := filepath.Join(b, "wiki", "w", "facts")
-			require.NoError(t, os.MkdirAll(facts, 0o755))
-			require.NoError(t, os.WriteFile(filepath.Join(facts, "ok.md"), []byte("---\ntitle: Zqinside Phrase\n---\n"), 0o644))
-			fifo := filepath.Join(facts, "f.md")
-			require.NoError(t, syscall.Mkfifo(fifo, 0o644))
-			if withWriter {
-				// A writer held open: a reader that opens the FIFO gets no
-				// EOF and parks, unless the FIFO is never opened.
-				w, err := os.OpenFile(fifo, os.O_RDWR, 0)
-				require.NoError(t, err)
-				t.Cleanup(func() { _ = w.Close() })
-			}
-			done := make(chan []brain.TunnelCandidate, 1)
-			go func() {
-				cs, _ := brain.DetectTunnels(b, "text mentioning zqinside phrase here")
-				done <- cs
-			}()
-			select {
-			case cs := <-done:
-				assert.Contains(t, fmt.Sprintf("%+v", cs), "Zqinside Phrase", "positive control")
-			case <-time.After(3 * time.Second):
-				if r, err := os.OpenFile(fifo, os.O_WRONLY|syscall.O_NONBLOCK, 0); err == nil {
-					_ = r.Close()
-				}
-				t.Fatal("DetectTunnels blocked on a FIFO")
-			}
-		})
-	}
-}
-
-func TestDetectTunnelsRefusesSymlinkedNotesAndSurvivesSwapRaces(t *testing.T) {
-	b := t.TempDir()
-	facts := filepath.Join(b, "wiki", "w", "facts")
-	require.NoError(t, os.MkdirAll(facts, 0o755))
-	// The static note's title differs from the raced note's, so the
-	// harness's "inside was read" floor can only be met by reading r.md.
-	require.NoError(t, os.WriteFile(filepath.Join(facts, "ok.md"), []byte("---\ntitle: Zqstatic Words\n---\n"), 0o644))
-	require.NoError(t, os.Symlink(brainfstest.Outside(t), filepath.Join(facts, "out.md")))
-	inBrain := brainfstest.WriteSentinelAt(t, filepath.Join(b, "raw", "s.md"))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "..", "raw", "s.md"), filepath.Join(facts, "in.md")))
-	content := "zqstatic words, zqinside phrase and " + brainfstest.Sentinel
-
-	cs, err := brain.DetectTunnels(b, content)
-	require.NoError(t, err)
-	got := fmt.Sprintf("%+v", cs)
-	assert.Contains(t, got, "Zqstatic Words", "positive control")
-	assert.NotContains(t, got, brainfstest.Sentinel)
-
-	p := filepath.Join(facts, "r.md")
-	read := func() string {
-		cs, _ := brain.DetectTunnels(b, content)
-		return fmt.Sprintf("%+v", cs)
-	}
-	brainfstest.AssertNoLeak(t, p, "---\ntitle: Zqinside Phrase\n---\n", 1500*time.Millisecond, read)
-	brainfstest.AssertNoLeakFrom(t, p, "---\ntitle: Zqinside Phrase\n---\n", inBrain, 1500*time.Millisecond, read)
-}
-
-// A wiki/ that is not a real directory yields no candidates and no error:
-// AutoTunnel runs inside brain_write.
-func TestDetectTunnelsSkipsAWikiThatIsNotARealDirectory(t *testing.T) {
-	b := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(b, "raw", "w", "facts"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(b, "raw", "w", "facts", "r.md"), []byte("---\ntitle: Zqrawonly Phrase\n---\n"), 0o644))
-	require.NoError(t, os.Symlink("raw", filepath.Join(b, "wiki")))
-	cs, err := brain.DetectTunnels(b, "zqrawonly phrase")
-	require.NoError(t, err)
-	assert.Empty(t, cs)
-}
-
-// An unreadable directory under wiki/ is a walk error and DetectTunnels
-// reports it, as filepath.WalkDir did; it is not silently dropped.
-func TestDetectTunnelsReportsAnUnreadableDirectoryUnderWiki(t *testing.T) {
-	if os.Geteuid() == 0 {
-		t.Skip("root ignores directory permissions")
-	}
-	b := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(b, "wiki", "w", "facts"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(b, "wiki", "w", "facts", "ok.md"), []byte("---\ntitle: Zqinside Phrase\n---\n"), 0o644))
-	locked := filepath.Join(b, "wiki", "other", "locked")
-	require.NoError(t, os.MkdirAll(locked, 0o755))
-	require.NoError(t, os.Chmod(locked, 0o000))
-	t.Cleanup(func() { _ = os.Chmod(locked, 0o755) })
-	_, err := brain.DetectTunnels(b, "zqinside phrase")
-	assert.ErrorIs(t, err, os.ErrPermission)
-}
-
-// _index.md files are generated, not notes: their title never becomes a
-// candidate.
-func TestDetectTunnelsSkipsIndexFiles(t *testing.T) {
-	b := t.TempDir()
-	w := filepath.Join(b, "wiki", "w")
-	require.NoError(t, os.MkdirAll(filepath.Join(w, "facts"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(w, "_index.md"), []byte("---\ntitle: Zqindex Words\n---\n"), 0o644))
-	require.NoError(t, os.WriteFile(filepath.Join(w, "facts", "ok.md"), []byte("---\ntitle: Zqinside Phrase\n---\n"), 0o644))
-	cs, err := brain.DetectTunnels(b, "zqindex words and zqinside phrase")
-	require.NoError(t, err)
-	got := fmt.Sprintf("%+v", cs)
-	assert.Contains(t, got, "Zqinside Phrase", "positive control")
-	assert.NotContains(t, got, "Zqindex")
-}
@@ -2,16 +2,12 @@ package brain

 import (
 	"bufio"
-	"bytes"
-	"errors"
 	"fmt"
-	"io"
-	"io/fs"
+	"os"
+	"path/filepath"
 	"sort"
 	"strings"
 	"time"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
 )

 // noteEntry is one row in a Wing _index.md.
@@ -30,18 +26,14 @@ func BuildWingIndex(brainDir, wing string) error {
 	if w == "" {
 		return fmt.Errorf("invalid wing %q", wing)
 	}
-	// Listed and read through the brain root (hyperguild#157): a wing or
-	// hall that is a symlink is not followed, and notes are regular files.
-	bfs, err := brainfs.Open(brainDir)
-	if err != nil {
-		return fmt.Errorf("open brain: %w", err)
-	}
-	defer func() { _ = bfs.Close() }()
-	if _, err := bfs.Lstat("wiki/" + w); errors.Is(err, fs.ErrNotExist) {
+	wingDir := filepath.Join(brainDir, "wiki", w)
+	if _, err := os.Stat(wingDir); os.IsNotExist(err) {
 		return nil
+	} else if err != nil {
+		return fmt.Errorf("stat wing: %w", err)
 	}

-	entries, err := collectWingEntries(bfs, "wiki/"+w)
+	entries, err := collectWingEntries(wingDir)
 	if err != nil {
 		return err
 	}
@@ -60,85 +52,74 @@ func BuildWingIndex(brainDir, wing string) error {
 		fmt.Fprintf(&b, "| %s | [%s](%s/%s.md) | %s |\n", e.Hall, e.Title, e.Hall, e.Slug, e.Created)
 	}

-	// Written through the brain root, never through a symlinked _index.md
-	// (hyperguild#158).
-	return bfs.PutRegular("wiki/"+w+"/_index.md", []byte(b.String()))
+	dest := filepath.Join(wingDir, "_index.md")
+	return os.WriteFile(dest, []byte(b.String()), 0o644)
 }

 // BuildAllWingIndexes regenerates _index.md for every wing under brain/wiki/.
 func BuildAllWingIndexes(brainDir string) error {
-	bfs, err := brainfs.Open(brainDir)
-	if err != nil {
-		return fmt.Errorf("open brain: %w", err)
-	}
-	wings, err := bfs.ReadDirDirs("wiki")
-	_ = bfs.Close()
-	if errors.Is(err, fs.ErrNotExist) {
+	wikiDir := filepath.Join(brainDir, "wiki")
+	ents, err := os.ReadDir(wikiDir)
+	if os.IsNotExist(err) {
 		return nil
 	}
 	if err != nil {
 		return fmt.Errorf("read wiki: %w", err)
 	}
-	for _, w := range wings {
-		if err := BuildWingIndex(brainDir, w); err != nil {
-			return fmt.Errorf("index %s: %w", w, err)
+	for _, e := range ents {
+		if !e.IsDir() {
+			continue
+		}
+		if err := BuildWingIndex(brainDir, e.Name()); err != nil {
+			return fmt.Errorf("index %s: %w", e.Name(), err)
 		}
 	}
 	return nil
 }

-func collectWingEntries(bfs *brainfs.Brain, wingRel string) ([]noteEntry, error) {
+func collectWingEntries(wingDir string) ([]noteEntry, error) {
 	var out []noteEntry
-	halls, err := bfs.ReadDirDirs(wingRel)
+	ents, err := os.ReadDir(wingDir)
 	if err != nil {
 		return nil, fmt.Errorf("read wing: %w", err)
 	}
-	for _, hall := range halls {
+	for _, hallEnt := range ents {
+		if !hallEnt.IsDir() {
+			continue
+		}
+		hall := hallEnt.Name()
 		if !IsValidHall(hall) {
 			continue
 		}
-		hallRel := wingRel + "/" + hall
-		names, err := bfs.ReadDirRegular(hallRel)
+		hallDir := filepath.Join(wingDir, hall)
+		notes, err := os.ReadDir(hallDir)
 		if err != nil {
 			return nil, fmt.Errorf("read hall %s: %w", hall, err)
 		}
-		for _, name := range names {
-			if !strings.HasSuffix(name, ".md") || name == "_index.md" {
+		for _, n := range notes {
+			if n.IsDir() || !strings.HasSuffix(n.Name(), ".md") || n.Name() == "_index.md" {
 				continue
 			}
-			slug := strings.TrimSuffix(name, ".md")
-			title, created := readTitleAndCreatedIn(bfs, hallRel+"/"+name, slug)
+			slug := strings.TrimSuffix(n.Name(), ".md")
+			full := filepath.Join(hallDir, n.Name())
+			title, created := readTitleAndCreated(full, slug)
 			out = append(out, noteEntry{Hall: hall, Slug: slug, Title: title, Created: created})
 		}
 	}
 	return out, nil
 }

-// readTitleAndCreatedIn is readTitleAndCreated through the brain root,
-// regular files only (hyperguild#157).
-func readTitleAndCreatedIn(bfs *brainfs.Brain, rel, slug string) (string, string) {
-	content, err := bfs.ReadRegular(rel)
+// readTitleAndCreated reads YAML frontmatter for title + created_at; falls
+// back to slug and file mtime when absent.
+func readTitleAndCreated(path, slug string) (string, string) {
+	f, err := os.Open(path)
 	if err != nil {
 		return slug, ""
 	}
-	title, created := parseTitleAndCreated(bytes.NewReader(content))
-	if created == "" {
-		if info, err := bfs.Lstat(rel); err == nil {
-			created = info.ModTime().UTC().Format("2006-01-02")
-		}
-	}
-	return titleOrSlug(title, slug), created
-}
+	defer func() { _ = f.Close() }()

-func titleOrSlug(title, slug string) string {
-	if title == "" {
-		return strings.ReplaceAll(slug, "-", " ")
-	}
-	return title
-}
-
-func parseTitleAndCreated(r io.Reader) (title, created string) {
-	scanner := bufio.NewScanner(r)
+	title, created := "", ""
+	scanner := bufio.NewScanner(f)
 	inFrontmatter := false
 	for scanner.Scan() {
 		line := scanner.Text()
@@ -168,5 +149,13 @@ func parseTitleAndCreated(r io.Reader) (title, created string) {
 			}
 		}
 	}
+	if title == "" {
+		title = strings.ReplaceAll(slug, "-", " ")
+	}
+	if created == "" {
+		if info, err := os.Stat(path); err == nil {
+			created = info.ModTime().UTC().Format("2006-01-02")
+		}
+	}
 	return title, created
 }
@@ -1,132 +0,0 @@
-package brain_test
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brain"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs/brainfstest"
-)
-
-func readIndex(t *testing.T, brainDir, wing string) string {
-	t.Helper()
-	b, _ := os.ReadFile(filepath.Join(brainDir, "wiki", wing, "_index.md"))
-	return string(b)
-}
-
-// hyperguild#157 slice 5: BuildWingIndex listed wiki/<wing>/<hall>/ with
-// os.ReadDir and opened each note by path, so a symlinked note put the
-// target's title into _index.md, and a FIFO hung the index build.
-func TestBuildWingIndexRefusesSymlinkedNotesAndSurvivesSwapRaces(t *testing.T) {
-	b := t.TempDir()
-	facts := filepath.Join(b, "wiki", "w", "facts")
-	require.NoError(t, os.MkdirAll(facts, 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(facts, "ok.md"), []byte("---\ntitle: zqinside\n---\n"), 0o644))
-	require.NoError(t, os.Symlink(brainfstest.Outside(t), filepath.Join(facts, "leak.md")))
-	inBrain := brainfstest.WriteSentinelAt(t, filepath.Join(b, "raw", "s.md"))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "..", "raw", "s.md"), filepath.Join(facts, "inlink.md")))
-
-	require.NoError(t, brain.BuildWingIndex(b, "w"))
-	idx := readIndex(t, b, "w")
-	assert.Contains(t, idx, "zqinside", "positive control")
-	assert.NotContains(t, idx, brainfstest.Sentinel)
-	assert.NotContains(t, idx, "leak")
-	assert.NotContains(t, idx, "inlink")
-
-	p := filepath.Join(facts, "r.md")
-	read := func() string {
-		_ = brain.BuildWingIndex(b, "w")
-		return readIndex(t, b, "w")
-	}
-	brainfstest.AssertNoLeak(t, p, "---\ntitle: zqinside\n---\n", 1500*time.Millisecond, read)
-	brainfstest.AssertNoLeakFrom(t, p, "---\ntitle: zqinside\n---\n", inBrain, 1500*time.Millisecond, read)
-	brainfstest.AssertNoHang(t, p, "---\ntitle: zqinside\n---\n", 1500*time.Millisecond, 6*time.Second, func() { _ = read() })
-}
-
-// A symlinked hall is skipped while a real hall next to it is indexed; a
-// symlinked wing is refused and nothing is written into its target.
-func TestBuildWingIndexSkipsASymlinkedHallAndRefusesASymlinkedWing(t *testing.T) {
-	b := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(b, "raw", "facts"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(b, "raw", "facts", "r.md"), []byte("---\ntitle: zqrawonly\n---\n"), 0o644))
-	require.NoError(t, os.MkdirAll(filepath.Join(b, "wiki", "w", "decisions"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(b, "wiki", "w", "decisions", "d.md"), []byte("---\ntitle: zqrealhall\n---\n"), 0o644))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "raw", "facts"), filepath.Join(b, "wiki", "w", "facts")))
-	require.NoError(t, os.Symlink(filepath.Join("..", "raw"), filepath.Join(b, "wiki", "alias")))
-
-	require.NoError(t, brain.BuildWingIndex(b, "w"))
-	idx, err := os.ReadFile(filepath.Join(b, "wiki", "w", "_index.md"))
-	require.NoError(t, err, "the wing index is written")
-	assert.Contains(t, string(idx), "zqrealhall", "the real hall is indexed")
-	assert.NotContains(t, string(idx), "zqrawonly", "the symlinked hall is not")
-
-	assert.Error(t, brain.BuildWingIndex(b, "alias"))
-	_, err = os.Stat(filepath.Join(b, "raw", "_index.md"))
-	assert.True(t, os.IsNotExist(err), "an index was written into the symlinked wing's target")
-}
-
-// BuildAllWingIndexes indexes the real wings and skips a symlinked one.
-func TestBuildAllWingIndexesSkipsASymlinkedWing(t *testing.T) {
-	b := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(b, "wiki", "w", "facts"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(b, "wiki", "w", "facts", "n.md"), []byte("---\ntitle: zqrealwing\n---\n"), 0o644))
-	require.NoError(t, os.MkdirAll(filepath.Join(b, "raw", "facts"), 0o755))
-	require.NoError(t, os.Symlink(filepath.Join("..", "raw"), filepath.Join(b, "wiki", "alias")))
-
-	require.NoError(t, brain.BuildAllWingIndexes(b))
-	idx, err := os.ReadFile(filepath.Join(b, "wiki", "w", "_index.md"))
-	require.NoError(t, err)
-	assert.Contains(t, string(idx), "zqrealwing")
-	_, err = os.Stat(filepath.Join(b, "raw", "_index.md"))
-	assert.True(t, os.IsNotExist(err))
-}
-
-// A link to a symlinked note does not resolve: only regular files count as
-// entries, so StripUnresolvedLinks unwraps it.
-func TestStripUnresolvedLinksDoesNotCountASymlinkedNoteAsAnEntry(t *testing.T) {
-	b := t.TempDir()
-	facts := filepath.Join(b, "wiki", "w", "facts")
-	require.NoError(t, os.MkdirAll(facts, 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(facts, "real.md"), []byte("x"), 0o644))
-	brainfstest.WriteSentinelAt(t, filepath.Join(b, "raw", "s.md"))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "..", "raw", "s.md"), filepath.Join(facts, "ghost.md")))
-	out, unlinked, err := brain.StripUnresolvedLinks(b, "see [[real]] and [[ghost]]")
-	require.NoError(t, err)
-	assert.Contains(t, out, "[[real]]", "positive control")
-	assert.NotContains(t, out, "[[ghost]]")
-	assert.Contains(t, unlinked, "ghost")
-}
-
-// A linked tree (knowledge/ or wiki/) that is not a real directory is
-// skipped, not an error: StripUnresolvedLinks runs before every brain_write,
-// and an error there loses the learning.
-func TestStripUnresolvedLinksSkipsALinkedTreeThatIsNotARealDirectory(t *testing.T) {
-	for name, mk := range map[string]func(t *testing.T, b string){
-		"symlink to an in-brain dir": func(t *testing.T, b string) {
-			require.NoError(t, os.MkdirAll(filepath.Join(b, "raw", "k"), 0o755))
-			require.NoError(t, os.Symlink(filepath.Join("raw", "k"), filepath.Join(b, "knowledge")))
-		},
-		"dangling symlink": func(t *testing.T, b string) {
-			require.NoError(t, os.Symlink("nowhere", filepath.Join(b, "knowledge")))
-		},
-		"regular file": func(t *testing.T, b string) {
-			require.NoError(t, os.WriteFile(filepath.Join(b, "knowledge"), []byte("x"), 0o644))
-		},
-	} {
-		t.Run(name, func(t *testing.T) {
-			b := t.TempDir()
-			require.NoError(t, os.MkdirAll(filepath.Join(b, "wiki", "w", "facts"), 0o755))
-			require.NoError(t, os.WriteFile(filepath.Join(b, "wiki", "w", "facts", "real.md"), []byte("x"), 0o644))
-			mk(t, b)
-			out, _, err := brain.StripUnresolvedLinks(b, "learning [[real]] and [[gone]]")
-			require.NoError(t, err)
-			assert.Contains(t, out, "[[real]]", "links into wiki/ still resolve")
-			assert.NotContains(t, out, "[[gone]]")
-		})
-	}
-}
@@ -1,16 +1,12 @@
 package brain

 import (
-	"errors"
 	"fmt"
-	"io/fs"
-	"log/slog"
-	"path"
+	"os"
+	"path/filepath"
 	"regexp"
 	"sort"
 	"strings"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
 )

 // wikilinkRE matches [[target]] and [[target|Display Text]].
@@ -47,12 +43,7 @@ var (
 func StripUnresolvedLinks(brainDir, content string) (string, []string, error) {
 	index, err := entryIndex(brainDir)
 	if err != nil {
-		// A partial index cannot tell an invented link from one into the
-		// part it could not read, so unwrap nothing, and do not refuse the
-		// write either: this runs before every brain_write, and a refused
-		// write is a lost learning (hyperguild#178).
-		slog.Warn("link check skipped: cannot index the brain", "err", err)
-		return content, nil, nil
+		return "", nil, err
 	}
 	if len(index) == 0 {
 		return content, nil, nil
@@ -107,40 +98,29 @@ var linkedTrees = []string{"knowledge", "wiki"}
 // one the audit will also resolve.
 func entryIndex(brainDir string) (map[string]struct{}, error) {
 	index := map[string]struct{}{}
-	// Walked through the brain root (hyperguild#157): only regular files
-	// count as entries, so a symlinked .md name cannot make a link resolve.
-	bfs, err := brainfs.Open(brainDir)
-	if err != nil {
-		return nil, fmt.Errorf("open brain: %w", err)
-	}
-	defer func() { _ = bfs.Close() }()
 	for _, dir := range linkedTrees {
-		if _, err := bfs.Lstat(dir); errors.Is(err, fs.ErrNotExist) {
+		root := filepath.Join(brainDir, dir)
+		if _, err := os.Stat(root); os.IsNotExist(err) {
 			continue
+		} else if err != nil {
+			return nil, fmt.Errorf("stat %s: %w", dir, err)
 		}
-		var walkErr error
-		err := bfs.WalkRegular(dir, func(rel string) error {
-			if !strings.HasSuffix(rel, ".md") {
+		err := filepath.WalkDir(root, func(path string, d os.DirEntry, err error) error {
+			if err != nil {
+				return err
+			}
+			if d.IsDir() || !strings.HasSuffix(path, ".md") {
 				return nil
 			}
-			index[strings.TrimSuffix(path.Base(rel), ".md")] = struct{}{}
+			rel, err := filepath.Rel(brainDir, path)
+			if err != nil {
+				return err
+			}
+			rel = filepath.ToSlash(rel)
+			index[strings.TrimSuffix(filepath.Base(rel), ".md")] = struct{}{}
 			index[strings.TrimPrefix(strings.TrimSuffix(rel, ".md"), "wiki/")] = struct{}{}
 			return nil
-		}, func(rel string, err error) {
-			// A linked tree that is not a real directory (a symlink, a
-			// file) is skipped, as filepath.WalkDir did: this runs before
-			// every brain_write, and an error here loses the learning.
-			if rel == dir && errors.Is(err, brainfs.ErrNotRegular) {
-				slog.Warn("link check: skipping a linked tree that is not a real directory", "dir", dir)
-				return
-			}
-			if walkErr == nil {
-				walkErr = fmt.Errorf("%s: %w", rel, err)
-			}
 		})
-		if err == nil {
-			err = walkErr
-		}
 		if err != nil {
 			return nil, fmt.Errorf("walk %s: %w", dir, err)
 		}
@@ -1,41 +0,0 @@
-package brain_test
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brain"
-)
-
-// hyperguild#178: StripUnresolvedLinks runs before every brain_write and
-// brain_update. An unreadable directory under knowledge/ or wiki/ made it
-// error, the write was refused and the learning lost. When the link index
-// cannot be built, the content is now returned unchanged (no link is
-// unwrapped, none is invented) and no error stops the write.
-func TestStripUnresolvedLinksKeepsContentWhenTheIndexCannotBeBuilt(t *testing.T) {
-	if os.Geteuid() == 0 {
-		t.Skip("root ignores directory permissions")
-	}
-	b := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(b, "wiki", "w", "facts"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(b, "wiki", "w", "facts", "real.md"), []byte("x"), 0o644))
-	locked := filepath.Join(b, "wiki", "other", "locked")
-	require.NoError(t, os.MkdirAll(locked, 0o755))
-	require.NoError(t, os.Chmod(locked, 0o000))
-	t.Cleanup(func() { _ = os.Chmod(locked, 0o755) })
-
-	in := "learning [[real]] and [[gone]]"
-	out, unlinked, err := brain.StripUnresolvedLinks(b, in)
-	require.NoError(t, err)
-	assert.Equal(t, in, out, "content unchanged: no link unwrapped on a partial index")
-	assert.Empty(t, unlinked)
-
-	require.NoError(t, os.Chmod(locked, 0o755))
-	out, _, err = brain.StripUnresolvedLinks(b, in)
-	require.NoError(t, err)
-	assert.NotContains(t, out, "[[gone]]", "positive control: with a readable tree the strip runs")
-}
@@ -2,15 +2,11 @@ package brain

 import (
 	"bufio"
-	"errors"
 	"fmt"
-	"io/fs"
-	"path"
+	"os"
 	"path/filepath"
 	"strings"
 	"time"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
 )

 // seeAlsoHeader is the markdown heading used to group cross-wing links.
@@ -40,29 +36,24 @@ type TunnelCandidate struct {
 // A note's title is read from YAML frontmatter `title:`; failing that,
 // the filename slug (sans `.md`, hyphens → spaces) is used.
 func DetectTunnels(brainDir, content string) ([]TunnelCandidate, error) {
-	// Walked and read through the brain root, regular files only
-	// (hyperguild#174, #157): this runs inside every brain_write, so a FIFO
-	// must not block it and a symlinked note's title must not become a
-	// candidate.
-	bfs, err := brainfs.Open(brainDir)
-	if err != nil {
-		return nil, fmt.Errorf("open brain: %w", err)
-	}
-	defer func() { _ = bfs.Close() }()
-	if _, err := bfs.Lstat("wiki"); errors.Is(err, fs.ErrNotExist) {
+	wikiDir := filepath.Join(brainDir, "wiki")
+	if _, err := os.Stat(wikiDir); os.IsNotExist(err) {
 		return nil, nil
+	} else if err != nil {
+		return nil, fmt.Errorf("stat wiki: %w", err)
 	}

 	lowerContent := strings.ToLower(content)

 	var out []TunnelCandidate
-	var walkErr error
-	err = bfs.WalkRegular("wiki", func(rel string) error {
-		name := path.Base(rel)
-		if !strings.HasSuffix(name, ".md") || name == "_index.md" {
+	err := filepath.WalkDir(wikiDir, func(path string, d os.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if d.IsDir() || !strings.HasSuffix(path, ".md") || d.Name() == "_index.md" {
 			return nil
 		}
-		title, _ := readTitleAndCreatedIn(bfs, rel, strings.TrimSuffix(name, ".md"))
+		title, _ := readTitleAndCreated(path, strings.TrimSuffix(d.Name(), ".md"))
 		title = strings.TrimSpace(title)
 		if title == "" {
 			return nil
@@ -84,25 +75,17 @@ func DetectTunnels(brainDir, content string) ([]TunnelCandidate, error) {
 		if idx == -1 {
 			return nil
 		}
+		rel, err := filepath.Rel(brainDir, path)
+		if err != nil {
+			return err
+		}
 		out = append(out, TunnelCandidate{
-			TargetPath:  rel,
+			TargetPath:  filepath.ToSlash(rel),
 			MatchedTerm: title,
 			Exact:       isWholeWord(haystack, idx, len(needle)),
 		})
 		return nil
-	}, func(rel string, err error) {
-		// A wiki/ that is not a real directory yields no candidates, as
-		// filepath.WalkDir did; other walk errors still abort.
-		if rel == "wiki" && errors.Is(err, brainfs.ErrNotRegular) {
-			return
-		}
-		if walkErr == nil {
-			walkErr = fmt.Errorf("%s: %w", rel, err)
-		}
 	})
-	if err == nil {
-		err = walkErr
-	}
 	if err != nil {
 		return nil, err
 	}
@@ -175,23 +158,35 @@ func logFuzzyCandidates(brainDir, sourcePath string, cs []TunnelCandidate) error
 	if len(cs) == 0 {
 		return nil
 	}
-	// Appended through the brain root, never through a symlinked raw/ or
-	// log file (hyperguild#158).
-	bfs, err := brainfs.Open(brainDir)
-	if err != nil {
-		return fmt.Errorf("open brain: %w", err)
+	rawDir := filepath.Join(brainDir, "raw")
+	if err := os.MkdirAll(rawDir, 0o755); err != nil {
+		return err
 	}
-	defer func() { _ = bfs.Close() }()
 	stamp := time.Now().UTC().Format("2006-01-02")
-	rel := "raw/tunnel-candidates-" + stamp + ".md"
-	var buf strings.Builder
-	if _, err := bfs.Lstat(rel); errors.Is(err, fs.ErrNotExist) {
-		buf.WriteString("# Tunnel candidates " + stamp + "\n\nFuzzy cross-wing matches surfaced by AutoTunnel. Review and promote to a tunnel via `brain_tunnel` if relevant.\n\n")
+	path := filepath.Join(rawDir, "tunnel-candidates-"+stamp+".md")
+	existed := fileExists(path)
+	f, err := os.OpenFile(path, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o644)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = f.Close() }()
+	if !existed {
+		if _, err := f.WriteString("# Tunnel candidates " + stamp + "\n\nFuzzy cross-wing matches surfaced by AutoTunnel. Review and promote to a tunnel via `brain_tunnel` if relevant.\n\n"); err != nil {
+			return err
+		}
 	}
 	for _, c := range cs {
-		fmt.Fprintf(&buf, "- `%s` ↔ `%s` (term: %q)\n", sourcePath, c.TargetPath, c.MatchedTerm)
+		line := fmt.Sprintf("- `%s` ↔ `%s` (term: %q)\n", sourcePath, c.TargetPath, c.MatchedTerm)
+		if _, err := f.WriteString(line); err != nil {
+			return err
+		}
 	}
-	return bfs.AppendRegular(rel, []byte(buf.String()))
+	return nil
+}
+
+func fileExists(p string) bool {
+	_, err := os.Stat(p)
+	return err == nil
 }

 // WriteTunnel appends a bidirectional wikilink between sourcePath and
@@ -202,12 +197,6 @@ func logFuzzyCandidates(brainDir, sourcePath string, cs []TunnelCandidate) error
 // section headers. Rejects same-wing pairs (a tunnel is by definition
 // cross-wing) and missing notes.
 func WriteTunnel(brainDir, sourcePath, targetPath string) error {
-	if err := checkNotePath(sourcePath); err != nil {
-		return fmt.Errorf("source: %w", err)
-	}
-	if err := checkNotePath(targetPath); err != nil {
-		return fmt.Errorf("target: %w", err)
-	}
 	srcWing, err := wingOf(sourcePath)
 	if err != nil {
 		return fmt.Errorf("source: %w", err)
@@ -220,50 +209,20 @@ func WriteTunnel(brainDir, sourcePath, targetPath string) error {
 		return fmt.Errorf("tunnel must cross wings; got both in %q", srcWing)
 	}

-	// Both notes are read and rewritten through the brain root, regular
-	// files only: brain_tunnel passes caller-supplied paths, and the brain is
-	// a Syncthing folder that can hold symlinks.
-	bfs, err := brainfs.Open(brainDir)
-	if err != nil {
-		return fmt.Errorf("open brain: %w", err)
-	}
-	defer func() { _ = bfs.Close() }()
-	srcContent, err := bfs.ReadRegular(sourcePath)
-	if err != nil {
+	srcFull := filepath.Join(brainDir, filepath.FromSlash(sourcePath))
+	tgtFull := filepath.Join(brainDir, filepath.FromSlash(targetPath))
+	if _, err := os.Stat(srcFull); err != nil {
 		return fmt.Errorf("source note: %w", err)
 	}
-	tgtContent, err := bfs.ReadRegular(targetPath)
-	if err != nil {
+	if _, err := os.Stat(tgtFull); err != nil {
 		return fmt.Errorf("target note: %w", err)
 	}

-	if out, changed, err := withSeeAlso(srcContent, wikilinkOf(targetPath)); err != nil {
+	if err := appendSeeAlso(srcFull, wikilinkOf(targetPath)); err != nil {
 		return fmt.Errorf("update source: %w", err)
-	} else if changed {
-		if err := bfs.WriteRegular(sourcePath, out); err != nil {
-			return fmt.Errorf("update source: %w", err)
-		}
 	}
-	if out, changed, err := withSeeAlso(tgtContent, wikilinkOf(sourcePath)); err != nil {
+	if err := appendSeeAlso(tgtFull, wikilinkOf(sourcePath)); err != nil {
 		return fmt.Errorf("update target: %w", err)
-	} else if changed {
-		if err := bfs.WriteRegular(targetPath, out); err != nil {
-			return fmt.Errorf("update target: %w", err)
-		}
-	}
-	return nil
-}
-
-// checkNotePath accepts only a clean, local wiki/<wing>/<hall>/.../<slug>.md
-// path: no "." or ".." segments, no empty segments, no leading slash.
-func checkNotePath(p string) error {
-	if p == "" || path.Clean(p) != p || !filepath.IsLocal(p) || !strings.HasSuffix(p, ".md") {
-		return fmt.Errorf("not a clean wiki note path: %q", p)
-	}
-	for _, part := range strings.Split(p, "/") {
-		if part == "" || part == "." || part == ".." {
-			return fmt.Errorf("not a clean wiki note path: %q", p)
-		}
 	}
 	return nil
 }
@@ -289,13 +248,16 @@ func wingOf(relPath string) (string, error) {
 	return parts[1], nil
 }

-// withSeeAlso returns content with `- [[link]]` under its See also section,
-// creating the section if absent. changed is false when the link is already
-// present.
-func withSeeAlso(content []byte, link string) (out []byte, changed bool, err error) {
+// appendSeeAlso inserts `- [[link]]` under the file's See also section,
+// creating the section if absent. No-op when the link is already present.
+func appendSeeAlso(filePath, link string) error {
+	content, err := os.ReadFile(filePath)
+	if err != nil {
+		return err
+	}
 	wikilink := "[[" + link + "]]"
 	if strings.Contains(string(content), wikilink) {
-		return content, false, nil
+		return nil
 	}

 	bullet := "- " + wikilink
@@ -304,7 +266,8 @@ func withSeeAlso(content []byte, link string) (out []byte, changed bool, err err
 		// No section yet — append a fresh one. Always emit a trailing
 		// newline so subsequent appends don't merge into the previous line.
 		trimmed := strings.TrimRight(string(content), "\n")
-		return []byte(trimmed + "\n\n" + seeAlsoHeader + "\n\n" + bullet + "\n"), true, nil
+		out := trimmed + "\n\n" + seeAlsoHeader + "\n\n" + bullet + "\n"
+		return os.WriteFile(filePath, []byte(out), 0o644)
 	}

 	// Section exists — splice the bullet in just before the next `## `
@@ -330,11 +293,12 @@ func withSeeAlso(content []byte, link string) (out []byte, changed bool, err err
 		b.WriteByte('\n')
 	}
 	if err := scanner.Err(); err != nil {
-		return nil, false, err
+		return err
 	}
 	if !inserted {
 		// section was the last thing in the file — just append bullet
-		return []byte(strings.TrimRight(b.String(), "\n") + "\n" + bullet + "\n"), true, nil
+		out := strings.TrimRight(b.String(), "\n") + "\n" + bullet + "\n"
+		return os.WriteFile(filePath, []byte(out), 0o644)
 	}
-	return []byte(b.String()), true, nil
+	return os.WriteFile(filePath, []byte(b.String()), 0o644)
 }
@@ -1,38 +0,0 @@
-package brain_test
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brain"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
-)
-
-// hyperguild#173: brain_tunnel's write followed a directory symlink inside
-// wiki/ that points elsewhere in the brain.
-func TestWriteTunnelRefusesATargetBehindASymlinkedDirectory(t *testing.T) {
-	b := t.TempDir()
-	src := filepath.Join(b, "wiki", "a", "facts", "s.md")
-	require.NoError(t, os.MkdirAll(filepath.Dir(src), 0o755))
-	require.NoError(t, os.WriteFile(src, []byte("x\n"), 0o644))
-	victim := filepath.Join(b, "raw", "facts", "v.md")
-	require.NoError(t, os.MkdirAll(filepath.Dir(victim), 0o755))
-	require.NoError(t, os.WriteFile(victim, []byte("untouched\n"), 0o644))
-	require.NoError(t, os.MkdirAll(filepath.Join(b, "wiki", "b"), 0o755))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "raw", "facts"), filepath.Join(b, "wiki", "b", "facts")))
-
-	assert.ErrorIs(t, brain.WriteTunnel(b, "wiki/a/facts/s.md", "wiki/b/facts/v.md"), brainfs.ErrNotRegular)
-	got, _ := os.ReadFile(victim)
-	assert.Equal(t, "untouched\n", string(got))
-	got, _ = os.ReadFile(src)
-	assert.Equal(t, "x\n", string(got), "the source is not rewritten either")
-
-	real := filepath.Join(b, "wiki", "c", "facts", "t.md")
-	require.NoError(t, os.MkdirAll(filepath.Dir(real), 0o755))
-	require.NoError(t, os.WriteFile(real, []byte("t\n"), 0o644))
-	require.NoError(t, brain.WriteTunnel(b, "wiki/a/facts/s.md", "wiki/c/facts/t.md"), "positive control: a tunnel between real directories is written")
-}
@@ -1,141 +0,0 @@
-package brain_test
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brain"
-)
-
-// brain_tunnel passes caller-supplied source and target paths to WriteTunnel,
-// which checked only "wiki/<wing>/..." and then joined them onto the brain
-// dir: ".." segments resolved outside the brain and appendSeeAlso rewrote the
-// file there.
-func TestWriteTunnelRefusesATargetThatTraversesOutOfTheBrain(t *testing.T) {
-	brain0 := t.TempDir()
-	src := filepath.Join(brain0, "wiki", "a", "facts", "s.md")
-	require.NoError(t, os.MkdirAll(filepath.Dir(src), 0o755))
-	require.NoError(t, os.WriteFile(src, []byte("---\ntitle: S\n---\nbody\n"), 0o644))
-	victim := filepath.Join(t.TempDir(), "victim.md")
-	require.NoError(t, os.WriteFile(victim, []byte("untouched\n"), 0o644))
-
-	up := strings.Repeat("../", strings.Count(filepath.Clean(brain0), "/")+3)
-	target := "wiki/b/x/" + up + strings.TrimPrefix(victim, "/")
-	err := brain.WriteTunnel(brain0, "wiki/a/facts/s.md", target)
-	assert.Error(t, err)
-	got, rerr := os.ReadFile(victim)
-	require.NoError(t, rerr)
-	assert.Equal(t, "untouched\n", string(got), "a file outside the brain was modified")
-}
-
-func TestWriteTunnelRefusesUncleanOrNonWikiPaths(t *testing.T) {
-	brain0 := t.TempDir()
-	for _, p := range []string{"wiki/a/facts/s.md", "wiki/b/facts/t.md", "wiki/b/facts/t.txt", "raw/r.md"} {
-		require.NoError(t, os.MkdirAll(filepath.Dir(filepath.Join(brain0, p)), 0o755))
-		require.NoError(t, os.WriteFile(filepath.Join(brain0, p), []byte("x\n"), 0o644))
-	}
-	for _, target := range []string{
-		"wiki/b/facts/../../../raw/r.md",
-		"wiki/b/./facts/t.md",
-		"wiki/b//facts/t.md",
-		"/wiki/b/facts/t.md",
-		"wiki/b/facts/t.txt",
-		"wiki/b/facts/",
-	} {
-		assert.Error(t, brain.WriteTunnel(brain0, "wiki/a/facts/s.md", target), target)
-	}
-	for _, p := range []string{"raw/r.md", "wiki/b/facts/t.txt"} {
-		got, err := os.ReadFile(filepath.Join(brain0, p))
-		require.NoError(t, err)
-		assert.Equal(t, "x\n", string(got), p)
-	}
-	require.NoError(t, brain.WriteTunnel(brain0, "wiki/a/facts/s.md", "wiki/b/facts/t.md"), "positive control")
-	got, err := os.ReadFile(filepath.Join(brain0, "wiki", "b", "facts", "t.md"))
-	require.NoError(t, err)
-	assert.Contains(t, string(got), "[[a/facts/s]]")
-}
-
-func TestWriteTunnelDoesNotWriteThroughASymlinkedNote(t *testing.T) {
-	brain0 := t.TempDir()
-	src := filepath.Join(brain0, "wiki", "a", "facts", "s.md")
-	require.NoError(t, os.MkdirAll(filepath.Dir(src), 0o755))
-	require.NoError(t, os.WriteFile(src, []byte("x\n"), 0o644))
-	tdir := filepath.Join(brain0, "wiki", "b", "facts")
-	require.NoError(t, os.MkdirAll(tdir, 0o755))
-	victim := filepath.Join(t.TempDir(), "victim.md")
-	require.NoError(t, os.WriteFile(victim, []byte("untouched\n"), 0o644))
-	require.NoError(t, os.Symlink(victim, filepath.Join(tdir, "t.md")))
-	assert.Error(t, brain.WriteTunnel(brain0, "wiki/a/facts/s.md", "wiki/b/facts/t.md"))
-	got, err := os.ReadFile(victim)
-	require.NoError(t, err)
-	assert.Equal(t, "untouched\n", string(got))
-
-	// The same with a link to a file elsewhere in the brain, which os.Root
-	// would follow.
-	inVictim := filepath.Join(brain0, "raw", "v.md")
-	require.NoError(t, os.MkdirAll(filepath.Dir(inVictim), 0o755))
-	require.NoError(t, os.WriteFile(inVictim, []byte("untouched\n"), 0o644))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "..", "raw", "v.md"), filepath.Join(tdir, "u.md")))
-	assert.Error(t, brain.WriteTunnel(brain0, "wiki/a/facts/s.md", "wiki/b/facts/u.md"))
-	got, err = os.ReadFile(inVictim)
-	require.NoError(t, err)
-	assert.Equal(t, "untouched\n", string(got))
-	got, err = os.ReadFile(src)
-	require.NoError(t, err)
-	assert.Equal(t, "x\n", string(got), "the source is not touched when the target is refused")
-}
-
-// The target is swapped between a regular note and a symlink to an in-brain
-// file outside wiki/ while WriteTunnel runs: the read and the write each
-// refuse a symlink, so the other file is never rewritten.
-func TestWriteTunnelNeverRewritesASymlinkSwappedInForTheTarget(t *testing.T) {
-	brain0 := t.TempDir()
-	src := filepath.Join(brain0, "wiki", "a", "facts", "s.md")
-	require.NoError(t, os.MkdirAll(filepath.Dir(src), 0o755))
-	require.NoError(t, os.WriteFile(src, []byte("x\n"), 0o644))
-	tdir := filepath.Join(brain0, "wiki", "b", "facts")
-	require.NoError(t, os.MkdirAll(tdir, 0o755))
-	victim := filepath.Join(brain0, "raw", "victim.md")
-	require.NoError(t, os.MkdirAll(filepath.Dir(victim), 0o755))
-	require.NoError(t, os.WriteFile(victim, []byte("untouched\n"), 0o644))
-	tgt := filepath.Join(tdir, "t.md")
-	require.NoError(t, os.WriteFile(tgt, []byte("t\n"), 0o644))
-
-	var stop atomic.Bool
-	var wg sync.WaitGroup
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		tmp := tgt + ".swap"
-		for i := 0; !stop.Load(); i++ {
-			_ = os.Remove(tmp)
-			if i%2 == 0 {
-				_ = os.WriteFile(tmp, []byte("t\n"), 0o644)
-			} else {
-				_ = os.Symlink(filepath.Join("..", "..", "..", "raw", "victim.md"), tmp)
-			}
-			_ = os.Rename(tmp, tgt)
-		}
-	}()
-	ok := 0
-	for deadline := time.Now().Add(1500 * time.Millisecond); time.Now().Before(deadline); {
-		if brain.WriteTunnel(brain0, "wiki/a/facts/s.md", "wiki/b/facts/t.md") == nil {
-			ok++
-		}
-		_ = os.WriteFile(src, []byte("x\n"), 0o644)
-	}
-	stop.Store(true)
-	wg.Wait()
-	got, err := os.ReadFile(victim)
-	require.NoError(t, err)
-	assert.Equal(t, "untouched\n", string(got), "the swapped-in symlink's target was rewritten")
-	assert.Positive(t, ok, "positive control: some tunnels were written to the regular target")
-}
@@ -1,52 +0,0 @@
-package brain_test
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brain"
-)
-
-// hyperguild#158: BuildWingIndex wrote wiki/<wing>/_index.md with
-// os.WriteFile, so a symlinked _index.md was written through.
-func TestBuildWingIndexDoesNotWriteThroughASymlinkedIndex(t *testing.T) {
-	b := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(b, "wiki", "w", "facts"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(b, "wiki", "w", "facts", "n.md"), []byte("---\ntitle: zqn\n---\n"), 0o644))
-	victim := filepath.Join(b, "raw", "v.md")
-	require.NoError(t, os.MkdirAll(filepath.Dir(victim), 0o755))
-	require.NoError(t, os.WriteFile(victim, []byte("untouched"), 0o644))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "raw", "v.md"), filepath.Join(b, "wiki", "w", "_index.md")))
-	assert.Error(t, brain.BuildWingIndex(b, "w"))
-	got, _ := os.ReadFile(victim)
-	assert.Equal(t, "untouched", string(got))
-
-	require.NoError(t, os.Remove(filepath.Join(b, "wiki", "w", "_index.md")))
-	require.NoError(t, brain.BuildWingIndex(b, "w"), "positive control")
-	idx, _ := os.ReadFile(filepath.Join(b, "wiki", "w", "_index.md"))
-	assert.Contains(t, string(idx), "zqn")
-}
-
-// AutoTunnel's fuzzy-candidate log appended to raw/tunnel-candidates-*.md
-// with os.OpenFile, so a symlinked raw/ (or log file) was written through.
-func TestAutoTunnelDoesNotAppendTheCandidateLogThroughASymlinkedRaw(t *testing.T) {
-	b := t.TempDir()
-	outside := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(b, "wiki", "a", "facts"), 0o755))
-	require.NoError(t, os.MkdirAll(filepath.Join(b, "wiki", "b", "facts"), 0o755))
-	// "zq widget" matches as a substring of "zq widgets", a fuzzy candidate.
-	require.NoError(t, os.WriteFile(filepath.Join(b, "wiki", "b", "facts", "t.md"), []byte("---\ntitle: Zq Widget\n---\n"), 0o644))
-	require.NoError(t, os.Symlink(outside, filepath.Join(b, "raw")))
-	_ = brain.AutoTunnel(b, "wiki/a/facts/s.md", "about zq widgets")
-	ents, _ := os.ReadDir(outside)
-	assert.Empty(t, ents, "the candidate log was written outside the brain")
-
-	require.NoError(t, os.Remove(filepath.Join(b, "raw")))
-	require.NoError(t, brain.AutoTunnel(b, "wiki/a/facts/s.md", "about zq widgets"))
-	logs, _ := filepath.Glob(filepath.Join(b, "raw", "tunnel-candidates-*.md"))
-	assert.Len(t, logs, 1, "positive control: the fuzzy candidate is logged in the real raw/")
-}
@@ -1,508 +0,0 @@
-// Package brainfs reads the brain directory through an os.Root (hyperguild#157).
-// The brain dir is a Syncthing sendreceive folder and Syncthing syncs
-// symlinks; a reader that walks and reads by path follows a planted symlink
-// out of the brain, and blocks forever on a planted FIFO. Readers that go
-// through a Brain only ever read regular files inside the brain: os.Root
-// refuses to leave the root even if an entry is swapped mid-read, and every
-// open is non-blocking with the type checked on the opened handle.
-package brainfs
-
-import (
-	"errors"
-	"fmt"
-	"io"
-	"io/fs"
-	"os"
-	"path"
-	"path/filepath"
-	"strings"
-	"syscall"
-)
-
-// ErrNotRegular is returned for an entry that is not a regular file.
-var ErrNotRegular = errors.New("not a regular file")
-
-// ErrLockChanged is returned by OpenLock when the lock file was replaced
-// while it was being opened.
-var ErrLockChanged = errors.New("lock file replaced while opening")
-
-// ErrTooLarge is returned by ReadRegularMax for a file over the limit.
-var ErrTooLarge = errors.New("file too large")
-
-// Brain is an open brain directory.
-type Brain struct {
-	root *os.Root
-	dir  string
-}
-
-// Open opens brainDir (which may itself be a mount symlink) as a root.
-func Open(brainDir string) (*Brain, error) {
-	r, err := os.OpenRoot(brainDir)
-	if err != nil {
-		return nil, fmt.Errorf("open brain root: %w", err)
-	}
-	return &Brain{root: r, dir: brainDir}, nil
-}
-
-// Close releases the root.
-func (b *Brain) Close() error { return b.root.Close() }
-
-// Rel converts a path under the brain dir to a root-relative path.
-func (b *Brain) Rel(path string) (string, error) {
-	rel, err := filepath.Rel(b.dir, path)
-	if err != nil {
-		return "", err
-	}
-	if rel == ".." || len(rel) > 2 && rel[:3] == ".."+string(filepath.Separator) {
-		return "", fmt.Errorf("%s is outside the brain dir", path)
-	}
-	return filepath.ToSlash(rel), nil
-}
-
-// Lstat stats a brain-relative path through the root without following a
-// final symlink.
-func (b *Brain) Lstat(rel string) (fs.FileInfo, error) {
-	return b.root.Lstat(filepath.ToSlash(rel))
-}
-
-// realDir returns ErrNotRegular unless every component of rel is a real
-// directory. A swap after the check is not caught (accepted residual,
-// hyperguild#157).
-func (b *Brain) realDir(rel string) error {
-	if rel == "." {
-		return nil
-	}
-	prefix := ""
-	for _, part := range strings.Split(rel, "/") {
-		prefix = path.Join(prefix, part)
-		fi, err := b.root.Lstat(prefix)
-		if err != nil {
-			return err
-		}
-		if !fi.IsDir() {
-			return fmt.Errorf("%s: walk root component %s is not a directory: %w", rel, prefix, ErrNotRegular)
-		}
-	}
-	return nil
-}
-
-// ReadDirRegular lists the regular files directly in a brain-relative
-// directory, by name. Every component of relDir must be a real directory
-// (ErrNotRegular otherwise); symlinks, FIFOs, devices and subdirectories in
-// it are left out.
-func (b *Brain) ReadDirRegular(relDir string) ([]string, error) {
-	relDir = filepath.ToSlash(relDir)
-	if err := b.realDir(relDir); err != nil {
-		return nil, err
-	}
-	ents, err := fs.ReadDir(b.root.FS(), relDir)
-	if err != nil {
-		return nil, err
-	}
-	var names []string
-	for _, e := range ents {
-		if e.Type().IsRegular() {
-			names = append(names, e.Name())
-		}
-	}
-	return names, nil
-}
-
-// cleanRel refuses a path that is not clean and local. realDir checks the
-// cleaned parent, so the I/O must use that same path: os.Root resolves ".."
-// after following a symlink, and a ".." after a symlinked directory would
-// otherwise pass the check and redirect the read or write.
-func cleanRel(rel string) error {
-	if rel == "" || path.Clean(rel) != rel || !filepath.IsLocal(rel) || strings.Contains(rel, "\\") {
-		return fmt.Errorf("%q: not a clean brain-relative path: %w", rel, ErrNotRegular)
-	}
-	return nil
-}
-
-// ReadDirDirs lists the real subdirectories directly in a brain-relative
-// directory, by name. Every component of relDir must be a real directory
-// (ErrNotRegular otherwise); symlinks to directories are left out.
-func (b *Brain) ReadDirDirs(relDir string) ([]string, error) {
-	relDir = filepath.ToSlash(relDir)
-	if err := b.realDir(relDir); err != nil {
-		return nil, err
-	}
-	ents, err := fs.ReadDir(b.root.FS(), relDir)
-	if err != nil {
-		return nil, err
-	}
-	var names []string
-	for _, e := range ents {
-		if e.Type().IsDir() {
-			names = append(names, e.Name())
-		}
-	}
-	return names, nil
-}
-
-// PutRegular creates or replaces a regular file at a brain-relative path,
-// for creating writes (hyperguild#188, #158). Missing parent directories are
-// created one component at a time through the root, and every existing
-// component must be a real directory, so a symlinked directory cannot
-// redirect the write elsewhere in the brain or outside it. An existing file
-// is replaced only if it is regular (WriteRegular's checks); a new file is
-// created with O_EXCL and confirmed to be the file that was opened. A
-// directory swapped in after the checks is the #167 residual.
-func (b *Brain) PutRegular(rel string, data []byte) error {
-	if err := cleanRel(rel); err != nil {
-		return err
-	}
-	if err := b.mkdirReal(path.Dir(rel)); err != nil {
-		return err
-	}
-	if _, err := b.root.Lstat(rel); err == nil {
-		return b.WriteRegular(rel, data)
-	} else if !errors.Is(err, fs.ErrNotExist) {
-		return err
-	}
-	return b.createNew(rel, data)
-}
-
-// CreateRegular creates a new regular file at a brain-relative path, with
-// PutRegular's parent rules, and fails with fs.ErrExist if anything is
-// already there: for writers that must never overwrite (promote, reject).
-func (b *Brain) CreateRegular(rel string, data []byte) error {
-	if err := cleanRel(rel); err != nil {
-		return err
-	}
-	if err := b.mkdirReal(path.Dir(rel)); err != nil {
-		return err
-	}
-	return b.createNew(rel, data)
-}
-
-// createNew creates rel with O_EXCL and writes data only after confirming
-// the path is the regular file it created.
-func (b *Brain) createNew(rel string, data []byte) error {
-	f, err := b.root.OpenFile(rel, os.O_WRONLY|os.O_CREATE|os.O_EXCL|syscall.O_NOFOLLOW|syscall.O_NONBLOCK, 0o644)
-	if err != nil {
-		return err
-	}
-	defer func() { _ = f.Close() }()
-	hfi, herr := f.Stat()
-	lfi, lerr := b.root.Lstat(rel)
-	if herr != nil || lerr != nil || !lfi.Mode().IsRegular() || !os.SameFile(lfi, hfi) {
-		return fmt.Errorf("%s: changed while creating: %w", rel, ErrNotRegular)
-	}
-	if _, err := f.Write(data); err != nil {
-		return err
-	}
-	return f.Close()
-}
-
-// AppendRegular appends data to a regular file at a brain-relative path,
-// creating it (and missing parent directories, as PutRegular does) if it is
-// absent. It writes only after confirming the path is the regular file it
-// opened, so a final symlink or special file, or one swapped in, is refused.
-func (b *Brain) AppendRegular(rel string, data []byte) error {
-	if err := cleanRel(rel); err != nil {
-		return err
-	}
-	if err := b.mkdirReal(path.Dir(rel)); err != nil {
-		return err
-	}
-	if fi, err := b.root.Lstat(rel); err == nil && !fi.Mode().IsRegular() {
-		return fmt.Errorf("%s: %w", rel, ErrNotRegular)
-	} else if err != nil && !errors.Is(err, fs.ErrNotExist) {
-		return err
-	}
-	f, err := b.root.OpenFile(rel, os.O_WRONLY|os.O_APPEND|os.O_CREATE|syscall.O_NOFOLLOW|syscall.O_NONBLOCK, 0o644)
-	if err != nil {
-		return err
-	}
-	defer func() { _ = f.Close() }()
-	hfi, herr := f.Stat()
-	lfi, lerr := b.root.Lstat(rel)
-	if herr != nil || lerr != nil || !lfi.Mode().IsRegular() || !os.SameFile(lfi, hfi) {
-		return fmt.Errorf("%s: changed while opening: %w", rel, ErrNotRegular)
-	}
-	if _, err := f.Write(data); err != nil {
-		return err
-	}
-	return f.Close()
-}
-
-// Remove removes the file at a clean brain-relative path through the root,
-// refusing a path behind a symlinked directory. A final symlink is removed
-// itself, never its target.
-func (b *Brain) Remove(rel string) error {
-	if err := b.RealParent(rel); err != nil {
-		return err
-	}
-	return b.root.Remove(rel)
-}
-
-// RealParent returns ErrNotRegular unless rel is clean and every directory
-// above it is a real directory, for writers that do their own I/O (an atomic
-// rename) but must not be redirected by a symlinked directory.
-func (b *Brain) RealParent(rel string) error {
-	if err := cleanRel(rel); err != nil {
-		return err
-	}
-	return b.realDir(path.Dir(rel))
-}
-
-// mkdirReal makes sure every component of rel exists as a real directory,
-// creating missing ones through the root; an existing component that is
-// not a real directory is ErrNotRegular.
-func (b *Brain) mkdirReal(rel string) error {
-	if rel == "." {
-		return nil
-	}
-	prefix := ""
-	for _, part := range strings.Split(rel, "/") {
-		prefix = path.Join(prefix, part)
-		fi, err := b.root.Lstat(prefix)
-		if errors.Is(err, fs.ErrNotExist) {
-			if err := b.root.Mkdir(prefix, 0o755); err != nil && !errors.Is(err, fs.ErrExist) {
-				return err
-			}
-			fi, err = b.root.Lstat(prefix)
-		}
-		if err != nil {
-			return err
-		}
-		if !fi.IsDir() {
-			return fmt.Errorf("%s: component %s is not a directory: %w", rel, prefix, ErrNotRegular)
-		}
-	}
-	return nil
-}
-
-// OpenLock opens (creating if absent) a regular lock file at a clean
-// brain-relative path for flock, through the root (hyperguild#192): every
-// directory above it must be real, an existing lock must be a regular file,
-// and the opened handle must be the file at the path (os.Root follows an
-// in-root final symlink even with O_NOFOLLOW, so the Lstat pre-check is
-// what refuses a dangling in-brain link). A link swapped in between the
-// pre-check and the open can still have an empty file created at an in-brain
-// target before the refusal: the #167 residual. ErrLockChanged reports a
-// lock replaced while opening (a peer removed and recreated it); callers
-// retry.
-func (b *Brain) OpenLock(rel string) (*os.File, error) {
-	if err := b.RealParent(rel); err != nil {
-		return nil, err
-	}
-	if fi, err := b.root.Lstat(rel); err == nil && !fi.Mode().IsRegular() {
-		return nil, fmt.Errorf("%s: %w", rel, ErrNotRegular)
-	} else if err != nil && !errors.Is(err, fs.ErrNotExist) {
-		return nil, err
-	}
-	f, err := b.root.OpenFile(rel, os.O_RDWR|os.O_CREATE|syscall.O_NOFOLLOW|syscall.O_NONBLOCK, 0o644)
-	if err != nil {
-		return nil, err
-	}
-	hfi, herr := f.Stat()
-	lfi, lerr := b.root.Lstat(rel)
-	if herr != nil || !hfi.Mode().IsRegular() {
-		_ = f.Close()
-		return nil, fmt.Errorf("%s: %w", rel, ErrNotRegular)
-	}
-	if lerr != nil || !os.SameFile(lfi, hfi) {
-		_ = f.Close()
-		if lerr == nil && !lfi.Mode().IsRegular() {
-			return nil, fmt.Errorf("%s: %w", rel, ErrNotRegular)
-		}
-		return nil, fmt.Errorf("%s: %w", rel, ErrLockChanged)
-	}
-	return f, nil
-}
-
-// LockIsCurrent reports whether f is still the file at rel: after taking a
-// flock, a lock file removed and recreated by a peer means the flock is on
-// an orphaned inode and does not exclude anyone (hyperguild#192).
-func (b *Brain) LockIsCurrent(rel string, f *os.File) bool {
-	hfi, herr := f.Stat()
-	lfi, lerr := b.root.Lstat(rel)
-	return herr == nil && lerr == nil && os.SameFile(lfi, hfi)
-}
-
-// ReadRegular reads a brain-relative path, refusing anything that is not a
-// regular file, both before the open and on the opened handle.
-func (b *Brain) ReadRegular(rel string) ([]byte, error) {
-	if err := cleanRel(rel); err != nil {
-		return nil, err
-	}
-	if err := b.realDir(path.Dir(rel)); err != nil {
-		return nil, err
-	}
-	fi, err := b.root.Lstat(rel)
-	if err != nil {
-		return nil, err
-	}
-	if !fi.Mode().IsRegular() {
-		return nil, fmt.Errorf("%s: %w", rel, ErrNotRegular)
-	}
-	return b.readOpenedMax(rel, -1, fi)
-}
-
-// readOpened opens rel non-blocking and reads it only if the OPENED handle is
-// a regular file. This is the check that matters under a race: an entry
-// swapped for a FIFO after the Lstat, with a writer holding it open, would
-// otherwise park io.ReadAll forever (PR #161 review: removing it hung search
-// after 16 iterations).
-//
-// Accepted residual, as in api/rawroot.go: a HARD link to an outside file is
-// a regular file and is read. Syncthing syncs contents, not links, so a peer
-// cannot create one; fs.protected_hardlinks=1 and the pod's secrets are on a
-// different filesystem from the brain volume, so a local caller cannot link
-// them in. Refusing Nlink > 1 is the next step if either changes.
-func (b *Brain) readOpened(rel string) ([]byte, error) { return b.readOpenedMax(rel, -1, nil) }
-
-// ReadRegularMax is ReadRegular with a size limit, checked on the opened
-// handle before reading (max < 0 means no limit).
-func (b *Brain) ReadRegularMax(rel string, max int64) ([]byte, error) {
-	if err := cleanRel(rel); err != nil {
-		return nil, err
-	}
-	if err := b.realDir(path.Dir(rel)); err != nil {
-		return nil, err
-	}
-	fi, err := b.root.Lstat(rel)
-	if err != nil {
-		return nil, err
-	}
-	if !fi.Mode().IsRegular() {
-		return nil, fmt.Errorf("%s: %w", rel, ErrNotRegular)
-	}
-	return b.readOpenedMax(rel, max, fi)
-}
-
-// readOpenedMax opens rel and reads it if the opened handle is a regular file
-// and, when lfi is set, the same file the caller Lstat-ed: os.Root follows an
-// in-root final symlink even with O_NOFOLLOW, so a symlink to another brain
-// file swapped in between the Lstat and the open is refused only here.
-func (b *Brain) readOpenedMax(rel string, max int64, lfi fs.FileInfo) ([]byte, error) {
-	f, err := b.root.OpenFile(rel, os.O_RDONLY|syscall.O_NONBLOCK, 0)
-	if err != nil {
-		return nil, err
-	}
-	defer func() { _ = f.Close() }()
-	hfi, err := f.Stat()
-	if err != nil {
-		return nil, err
-	}
-	if !hfi.Mode().IsRegular() {
-		return nil, fmt.Errorf("%s: %w", rel, ErrNotRegular)
-	}
-	if lfi != nil && !os.SameFile(lfi, hfi) {
-		return nil, fmt.Errorf("%s: changed while opening: %w", rel, ErrNotRegular)
-	}
-	if max >= 0 && hfi.Size() > max {
-		return nil, fmt.Errorf("%s is %d bytes (limit %d): %w", rel, hfi.Size(), max, ErrTooLarge)
-	}
-	var r io.Reader = f
-	if wrapAfterStat != nil {
-		r = wrapAfterStat(r)
-	}
-	if max < 0 {
-		return io.ReadAll(r)
-	}
-	// The handle's size can grow after the check; bound the read itself.
-	data, err := io.ReadAll(io.LimitReader(r, max+1))
-	if err != nil {
-		return nil, err
-	}
-	if int64(len(data)) > max {
-		return nil, fmt.Errorf("%s grew past %d bytes while read: %w", rel, max, ErrTooLarge)
-	}
-	return data, nil
-}
-
-// wrapAfterStat is a test seam: it runs between the size check and the read,
-// and wraps the reader the read consumes. A package global: brainfs tests
-// must not use t.Parallel.
-var wrapAfterStat func(io.Reader) io.Reader
-
-// WalkRegular walks a brain-relative directory through the root and calls fn
-// for each regular file. Directories are descended; symlinks, FIFOs and
-// devices found by the walk are skipped. A walk root with any component that
-// is not a real directory goes to onErr as ErrNotRegular and nothing is
-// yielded. An entry error is passed to onErr and the walk continues; a nil
-// onErr ignores it.
-//
-// Accepted residual (hyperguild#157): a directory swapped for a symlink
-// between the listing and the read is followed. os.Root still keeps the read
-// inside the brain, but not inside relDir.
-func (b *Brain) WalkRegular(relDir string, fn func(rel string) error, onErr func(rel string, err error)) error {
-	relDir = filepath.ToSlash(relDir)
-	// fs.WalkDir stats its root with a follow, and os.Root allows a symlink
-	// that stays inside the brain: knowledge -> . would alias the whole
-	// brain. Require every component of the root to be a real directory
-	// (Lstat checks only the last one).
-	err := b.realDir(relDir)
-	if err != nil {
-		if onErr != nil {
-			onErr(relDir, err)
-		}
-		return nil
-	}
-	return fs.WalkDir(b.root.FS(), relDir, func(p string, d fs.DirEntry, err error) error {
-		if err != nil {
-			if onErr != nil {
-				onErr(p, err)
-			}
-			if d != nil && d.IsDir() {
-				return fs.SkipDir
-			}
-			return nil
-		}
-		if d.IsDir() || !d.Type().IsRegular() {
-			return nil
-		}
-		return fn(p)
-	})
-}
-
-// WriteRegular replaces the contents of an existing regular file at a
-// brain-relative path. It never creates a file and never writes through a
-// final symlink: os.Root.OpenFile follows an in-root final symlink even with
-// O_NOFOLLOW (verified on go1.27), so the path is Lstat-ed through the root
-// first and the opened handle must be that same file (os.SameFile), which
-// also catches a swap between the two. O_NONBLOCK keeps a FIFO from blocking
-// the open. Every directory above the file must be a real directory
-// (hyperguild#173); a directory swapped in after that check is the #167
-// residual.
-func (b *Brain) WriteRegular(rel string, data []byte) error {
-	if err := cleanRel(rel); err != nil {
-		return err
-	}
-	// Every directory above the file must be real: os.Root follows an
-	// in-brain intermediate symlink, which would redirect the write
-	// elsewhere in the brain (hyperguild#173). A swap after this check is
-	// the #167 residual.
-	if err := b.realDir(path.Dir(rel)); err != nil {
-		return err
-	}
-	lfi, err := b.root.Lstat(rel)
-	if err != nil {
-		return err
-	}
-	if !lfi.Mode().IsRegular() {
-		return fmt.Errorf("%s: %w", rel, ErrNotRegular)
-	}
-	f, err := b.root.OpenFile(rel, os.O_WRONLY|syscall.O_NOFOLLOW|syscall.O_NONBLOCK, 0)
-	if err != nil {
-		return err
-	}
-	defer func() { _ = f.Close() }()
-	fi, err := f.Stat()
-	if err != nil {
-		return err
-	}
-	if !fi.Mode().IsRegular() || !os.SameFile(lfi, fi) {
-		return fmt.Errorf("%s: changed while opening: %w", rel, ErrNotRegular)
-	}
-	if err := f.Truncate(0); err != nil {
-		return err
-	}
-	if _, err := f.Write(data); err != nil {
-		return err
-	}
-	return f.Close()
-}
@@ -1,577 +0,0 @@
-package brainfs
-
-import (
-	"errors"
-	"io"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"sync"
-	"sync/atomic"
-	"syscall"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// The handle check is what stops a FIFO swapped in after the Lstat. A FIFO
-// with no writer reads EOF at once, so a race test could not see the check
-// missing; here a writer holds the FIFO open, as any local process can, and
-// readOpened must refuse it promptly (PR #161 review).
-func TestReadOpenedRefusesAFIFOHeldOpenByAWriter(t *testing.T) {
-	dir := t.TempDir()
-	fifo := filepath.Join(dir, "p.md")
-	require.NoError(t, syscall.Mkfifo(fifo, 0o644))
-	w, err := os.OpenFile(fifo, os.O_RDWR, 0)
-	require.NoError(t, err)
-	defer func() { _ = w.Close() }()
-
-	b, err := Open(dir)
-	require.NoError(t, err)
-	defer func() { _ = b.Close() }()
-
-	done := make(chan error, 1)
-	go func() { _, err := b.readOpened("p.md"); done <- err }()
-	select {
-	case err := <-done:
-		assert.True(t, errors.Is(err, ErrNotRegular), "got %v", err)
-	case <-time.After(2 * time.Second):
-		t.Fatal("readOpened blocked on a FIFO with a writer")
-	}
-}
-
-func TestReadRegularRefusesSymlinksAndReadsRegularFiles(t *testing.T) {
-	dir := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "ok.md"), []byte("ok"), 0o644))
-	outside := filepath.Join(t.TempDir(), "s.md")
-	require.NoError(t, os.WriteFile(outside, []byte("secret"), 0o644))
-	require.NoError(t, os.Symlink(outside, filepath.Join(dir, "link.md")))
-	b, err := Open(dir)
-	require.NoError(t, err)
-	defer func() { _ = b.Close() }()
-	got, err := b.ReadRegular("ok.md")
-	require.NoError(t, err)
-	assert.Equal(t, "ok", string(got))
-	_, err = b.ReadRegular("link.md")
-	assert.True(t, errors.Is(err, ErrNotRegular), "got %v", err)
-	_, err = b.ReadRegular("../" + filepath.Base(outside))
-	assert.Error(t, err)
-}
-
-func TestRelAcceptsPathsInsideAndRefusesEscapes(t *testing.T) {
-	dir := t.TempDir()
-	b, err := Open(dir)
-	require.NoError(t, err)
-	defer func() { _ = b.Close() }()
-	for in, want := range map[string]string{
-		filepath.Join(dir, "wiki", "x.md"): "wiki/x.md",
-		filepath.Join(dir, "..foo", "x"):   "..foo/x",
-		dir:                                ".",
-	} {
-		got, err := b.Rel(in)
-		require.NoError(t, err, in)
-		assert.Equal(t, want, got, in)
-	}
-	for _, bad := range []string{filepath.Join(dir, "..", "x"), dir + "-evil/x", "/etc/passwd", filepath.Join(dir, "wiki", "..", "..", "x")} {
-		_, err := b.Rel(bad)
-		assert.Error(t, err, bad)
-	}
-}
-
-func TestWalkRegularYieldsOnlyRegularFiles(t *testing.T) {
-	dir := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "a"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "a", "n.md"), []byte("n"), 0o644))
-	require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(dir, "a", "dirlink")))
-	require.NoError(t, os.Symlink(filepath.Join(dir, "a", "n.md"), filepath.Join(dir, "a", "filelink.md")))
-	require.NoError(t, syscall.Mkfifo(filepath.Join(dir, "a", "p.md"), 0o644))
-	b, err := Open(dir)
-	require.NoError(t, err)
-	defer func() { _ = b.Close() }()
-	var got []string
-	require.NoError(t, b.WalkRegular(".", func(rel string) error { got = append(got, rel); return nil }, nil))
-	assert.Equal(t, []string{"a/n.md"}, got)
-}
-
-func TestReadRegularMaxRefusesAFileOverTheLimit(t *testing.T) {
-	dir := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "big.md"), make([]byte, 100), 0o644))
-	b, err := Open(dir)
-	require.NoError(t, err)
-	defer func() { _ = b.Close() }()
-	_, err = b.ReadRegularMax("big.md", 99)
-	assert.True(t, errors.Is(err, ErrTooLarge), "got %v", err)
-	got, err := b.ReadRegularMax("big.md", 100)
-	require.NoError(t, err)
-	assert.Len(t, got, 100)
-}
-
-func TestReadRegularMaxRefusesAndStopsReadingAFileThatGrowsPastTheLimit(t *testing.T) {
-	dir := t.TempDir()
-	p := filepath.Join(dir, "grow.md")
-	require.NoError(t, os.WriteFile(p, make([]byte, 10), 0o644))
-	consumed := &countingReader{}
-	wrapAfterStat = func(r io.Reader) io.Reader {
-		f, err := os.OpenFile(p, os.O_WRONLY|os.O_APPEND, 0)
-		require.NoError(t, err)
-		_, err = f.Write(make([]byte, 1000))
-		require.NoError(t, err)
-		require.NoError(t, f.Close())
-		consumed.r = r
-		return consumed
-	}
-	t.Cleanup(func() { wrapAfterStat = nil })
-	b, err := Open(dir)
-	require.NoError(t, err)
-	defer func() { _ = b.Close() }()
-	got, err := b.ReadRegularMax("grow.md", 100)
-	assert.True(t, errors.Is(err, ErrTooLarge), "got %v", err)
-	assert.Nil(t, got)
-	assert.LessOrEqual(t, consumed.n, 101, "read past max+1 bytes")
-}
-
-type countingReader struct {
-	r io.Reader
-	n int
-}
-
-func (c *countingReader) Read(p []byte) (int, error) {
-	n, err := c.r.Read(p)
-	c.n += n
-	return n, err
-}
-
-func TestLstatDoesNotFollowSymlinksAndRefusesEscapes(t *testing.T) {
-	dir := t.TempDir()
-	outside := filepath.Join(t.TempDir(), "o.md")
-	require.NoError(t, os.WriteFile(outside, []byte("o"), 0o644))
-	require.NoError(t, os.Symlink(outside, filepath.Join(dir, "l.md")))
-	b, err := Open(dir)
-	require.NoError(t, err)
-	defer func() { _ = b.Close() }()
-	fi, err := b.Lstat("l.md")
-	require.NoError(t, err)
-	assert.Equal(t, fs.ModeSymlink, fi.Mode().Type())
-	_, err = b.Lstat("../" + filepath.Base(filepath.Dir(outside)) + "/o.md")
-	assert.Error(t, err)
-}
-
-func TestWalkRegularReportsASymlinkedWalkRootAndYieldsNothing(t *testing.T) {
-	dir := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "real"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "real", "n.md"), []byte("n"), 0o644))
-	require.NoError(t, os.Symlink("real", filepath.Join(dir, "alias")))
-	b, err := Open(dir)
-	require.NoError(t, err)
-	defer func() { _ = b.Close() }()
-	var got []string
-	var errs []error
-	require.NoError(t, b.WalkRegular("alias", func(rel string) error { got = append(got, rel); return nil },
-		func(_ string, err error) { errs = append(errs, err) }))
-	assert.Empty(t, got)
-	require.Len(t, errs, 1)
-	assert.ErrorIs(t, errs[0], ErrNotRegular)
-}
-
-func TestWalkRegularReportsASymlinkedIntermediateComponentOfTheWalkRoot(t *testing.T) {
-	dir := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "real", "sub"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "real", "sub", "n.md"), []byte("n"), 0o644))
-	require.NoError(t, os.Symlink("real", filepath.Join(dir, "alias")))
-	b, err := Open(dir)
-	require.NoError(t, err)
-	defer func() { _ = b.Close() }()
-	var got []string
-	var errs []error
-	require.NoError(t, b.WalkRegular("alias/sub", func(rel string) error { got = append(got, rel); return nil },
-		func(_ string, err error) { errs = append(errs, err) }))
-	assert.Empty(t, got)
-	require.Len(t, errs, 1)
-	assert.ErrorIs(t, errs[0], ErrNotRegular)
-}
-
-func TestReadDirRegularListsOnlyRegularFilesAndRefusesSymlinkedComponents(t *testing.T) {
-	dir := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "a", "b", "sub"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "a", "b", "n.md"), []byte("n"), 0o644))
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "other.md"), []byte("o"), 0o644))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "other.md"), filepath.Join(dir, "a", "b", "l.md")))
-	require.NoError(t, syscall.Mkfifo(filepath.Join(dir, "a", "b", "f.md"), 0o644))
-	require.NoError(t, os.Symlink("a", filepath.Join(dir, "alias")))
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "x"), 0o755))
-	require.NoError(t, os.Symlink(filepath.Join("..", "a"), filepath.Join(dir, "x", "mid")))
-	b, err := Open(dir)
-	require.NoError(t, err)
-	defer func() { _ = b.Close() }()
-
-	names, err := b.ReadDirRegular("a/b")
-	require.NoError(t, err)
-	assert.Equal(t, []string{"n.md"}, names)
-	for _, rel := range []string{"alias/b", "x/mid/b"} {
-		_, err := b.ReadDirRegular(rel)
-		assert.ErrorIs(t, err, ErrNotRegular, rel)
-	}
-}
-
-// A final component swapped for a symlink to another regular file in the
-// brain between the Lstat and the open: os.Root follows in-root links, so
-// only comparing the two (os.SameFile) refuses it.
-func TestReadRegularDoesNotReturnAnInBrainFileSwappedInBehindASymlink(t *testing.T) {
-	dir := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "s.md"), []byte("zqsamefilesentinel"), 0o644))
-	p := filepath.Join(dir, "r.md")
-	require.NoError(t, os.WriteFile(p, []byte("inside"), 0o644))
-	b, err := Open(dir)
-	require.NoError(t, err)
-	defer func() { _ = b.Close() }()
-
-	var stop atomic.Bool
-	var wg sync.WaitGroup
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		tmp := p + ".swap"
-		for i := 0; !stop.Load(); i++ {
-			_ = os.Remove(tmp)
-			if i%2 == 0 {
-				_ = os.WriteFile(tmp, []byte("inside"), 0o644)
-			} else {
-				_ = os.Symlink("s.md", tmp)
-			}
-			_ = os.Rename(tmp, p)
-		}
-	}()
-	leaks, ok := 0, 0
-	for deadline := time.Now().Add(1500 * time.Millisecond); time.Now().Before(deadline); {
-		got, err := b.ReadRegular("r.md")
-		if err == nil {
-			ok++
-		}
-		if string(got) == "zqsamefilesentinel" {
-			leaks++
-		}
-		got, _ = b.ReadRegularMax("r.md", 1<<20)
-		if string(got) == "zqsamefilesentinel" {
-			leaks++
-		}
-	}
-	stop.Store(true)
-	wg.Wait()
-	assert.Zero(t, leaks)
-	assert.Positive(t, ok, "positive control: the regular file is read")
-}
-
-func TestWriteRegularRefusesFinalSymlinksFIFOsEscapesAndMissingFilesAndRewritesRegularFiles(t *testing.T) {
-	dir := t.TempDir()
-	outside := filepath.Join(t.TempDir(), "o.md")
-	require.NoError(t, os.WriteFile(outside, []byte("untouched"), 0o644))
-	require.NoError(t, os.Symlink(outside, filepath.Join(dir, "l.md")))
-	require.NoError(t, syscall.Mkfifo(filepath.Join(dir, "f.md"), 0o644))
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "n.md"), []byte("old content"), 0o644))
-	b, err := Open(dir)
-	require.NoError(t, err)
-	defer func() { _ = b.Close() }()
-
-	assert.Error(t, b.WriteRegular("l.md", []byte("x")))
-	got, _ := os.ReadFile(outside)
-	assert.Equal(t, "untouched", string(got))
-
-	// A symlink to another file inside the brain: os.Root would allow it,
-	// only O_NOFOLLOW refuses it.
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "in.md"), []byte("inside"), 0o644))
-	require.NoError(t, os.Symlink("in.md", filepath.Join(dir, "il.md")))
-	assert.Error(t, b.WriteRegular("il.md", []byte("x")))
-	got, _ = os.ReadFile(filepath.Join(dir, "in.md"))
-	assert.Equal(t, "inside", string(got))
-
-	// A reader held open, so a non-blocking write open would succeed. The
-	// Lstat type check refuses the FIFO first; the handle check and
-	// O_NONBLOCK matter only if it is swapped in after the Lstat.
-	r, err := os.OpenFile(filepath.Join(dir, "f.md"), os.O_RDONLY|syscall.O_NONBLOCK, 0)
-	require.NoError(t, err)
-	defer func() { _ = r.Close() }()
-	done := make(chan error, 1)
-	go func() { done <- b.WriteRegular("f.md", []byte("x")) }()
-	select {
-	case err := <-done:
-		assert.Error(t, err)
-	case <-time.After(3 * time.Second):
-		t.Fatal("WriteRegular hung on a FIFO")
-	}
-
-	assert.Error(t, b.WriteRegular("../"+filepath.Base(filepath.Dir(outside))+"/o.md", []byte("x")))
-	assert.Error(t, b.WriteRegular("missing.md", []byte("x")), "does not create files")
-
-	require.NoError(t, b.WriteRegular("n.md", []byte("new")))
-	got, _ = os.ReadFile(filepath.Join(dir, "n.md"))
-	assert.Equal(t, "new", string(got), "truncated and rewritten")
-}
-
-func TestReadDirDirsListsOnlyRealSubdirsAndRefusesSymlinkedComponents(t *testing.T) {
-	dir := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "a", "real"), 0o755))
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "other"), 0o755))
-	require.NoError(t, os.Symlink(filepath.Join("..", "other"), filepath.Join(dir, "a", "linked")))
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "a", "f.md"), []byte("f"), 0o644))
-	require.NoError(t, os.Symlink("a", filepath.Join(dir, "alias")))
-	b, err := Open(dir)
-	require.NoError(t, err)
-	defer func() { _ = b.Close() }()
-
-	names, err := b.ReadDirDirs("a")
-	require.NoError(t, err)
-	assert.Equal(t, []string{"real"}, names)
-	_, err = b.ReadDirDirs("alias")
-	assert.ErrorIs(t, err, ErrNotRegular)
-}
-
-// hyperguild#173: a file reached through a symlinked directory inside the
-// brain is refused for reads and writes, so a caller-supplied path cannot be
-// redirected to another part of the brain.
-func TestReadAndWriteRegularRefuseAFileBehindASymlinkedDirectory(t *testing.T) {
-	dir := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "raw"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "raw", "v.md"), []byte("untouched"), 0o644))
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "wiki"), 0o755))
-	require.NoError(t, os.Symlink(filepath.Join("..", "raw"), filepath.Join(dir, "wiki", "alias")))
-	b, err := Open(dir)
-	require.NoError(t, err)
-	defer func() { _ = b.Close() }()
-
-	_, err = b.ReadRegular("wiki/alias/v.md")
-	assert.ErrorIs(t, err, ErrNotRegular)
-	_, err = b.ReadRegularMax("wiki/alias/v.md", 100)
-	assert.ErrorIs(t, err, ErrNotRegular)
-	assert.ErrorIs(t, b.WriteRegular("wiki/alias/v.md", []byte("x")), ErrNotRegular)
-	got, _ := os.ReadFile(filepath.Join(dir, "raw", "v.md"))
-	assert.Equal(t, "untouched", string(got))
-	got, err = b.ReadRegular("raw/v.md")
-	require.NoError(t, err, "positive control: the real path still reads")
-	assert.Equal(t, "untouched", string(got))
-}
-
-// realDir checks the cleaned parent, so the I/O must use that same clean
-// path: os.Root resolves ".." after following a symlink, and a ".." placed
-// after a symlinked directory would otherwise pass the check and redirect.
-func TestReadAndWriteRegularRefuseAPathThatIsNotClean(t *testing.T) {
-	dir := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "raw", "facts"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "raw", "v.md"), []byte("untouched"), 0o644))
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "wiki"), 0o755))
-	require.NoError(t, os.Symlink(filepath.Join("..", "raw", "facts"), filepath.Join(dir, "wiki", "alias")))
-	b, err := Open(dir)
-	require.NoError(t, err)
-	defer func() { _ = b.Close() }()
-
-	for _, rel := range []string{"wiki/alias/../v.md", "./raw/v.md", "raw//v.md", "/raw/v.md"} {
-		got, err := b.ReadRegular(rel)
-		assert.ErrorIs(t, err, ErrNotRegular, rel)
-		assert.NotContains(t, string(got), "untouched", rel)
-		_, err = b.ReadRegularMax(rel, 100)
-		assert.ErrorIs(t, err, ErrNotRegular, rel)
-		assert.ErrorIs(t, b.WriteRegular(rel, []byte("OVERWRITTEN")), ErrNotRegular, rel)
-	}
-	got, _ := os.ReadFile(filepath.Join(dir, "raw", "v.md"))
-	assert.Equal(t, "untouched", string(got))
-}
-
-// hyperguild#188: PutRegular creates or replaces a regular file through the
-// root. Missing parent directories are created; an existing component that
-// is not a real directory, a final symlink or special file, and an unclean
-// path are refused, and nothing is created at a link's target.
-func TestPutRegularCreatesOrReplacesOnlyThroughRealDirectories(t *testing.T) {
-	dir := t.TempDir()
-	outside := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "raw"), 0o755))
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "wiki"), 0o755))
-	require.NoError(t, os.Symlink(filepath.Join("..", "raw"), filepath.Join(dir, "wiki", "inwing")))
-	require.NoError(t, os.Symlink(outside, filepath.Join(dir, "wiki", "outwing")))
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "raw", "v.md"), []byte("untouched"), 0o644))
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "wiki", "w"), 0o755))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "raw", "v.md"), filepath.Join(dir, "wiki", "w", "link.md")))
-	require.NoError(t, syscall.Mkfifo(filepath.Join(dir, "wiki", "w", "f.md"), 0o644))
-	b, err := Open(dir)
-	require.NoError(t, err)
-	defer func() { _ = b.Close() }()
-
-	for _, rel := range []string{"wiki/inwing/facts/n.md", "wiki/outwing/facts/n.md", "wiki/w/link.md", "wiki/w/f.md", "wiki/w/../../raw/v.md", "/abs.md"} {
-		assert.ErrorIs(t, b.PutRegular(rel, []byte("x")), ErrNotRegular, rel)
-	}
-	ents, _ := os.ReadDir(outside)
-	assert.Empty(t, ents, "nothing created outside the brain")
-	_, err = os.Stat(filepath.Join(dir, "raw", "facts"))
-	assert.True(t, os.IsNotExist(err), "nothing created through the in-brain link")
-	got, _ := os.ReadFile(filepath.Join(dir, "raw", "v.md"))
-	assert.Equal(t, "untouched", string(got))
-
-	require.NoError(t, b.PutRegular("wiki/new/facts/n.md", []byte("one")), "positive control: create with missing parents")
-	got, _ = os.ReadFile(filepath.Join(dir, "wiki", "new", "facts", "n.md"))
-	assert.Equal(t, "one", string(got))
-	require.NoError(t, b.PutRegular("wiki/new/facts/n.md", []byte("two")), "positive control: replace")
-	got, _ = os.ReadFile(filepath.Join(dir, "wiki", "new", "facts", "n.md"))
-	assert.Equal(t, "two", string(got))
-}
-
-func TestAppendRegularCreatesOrAppendsOnlyThroughRealDirectories(t *testing.T) {
-	dir := t.TempDir()
-	outside := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "raw"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "raw", "v.md"), []byte("untouched"), 0o644))
-	require.NoError(t, os.Symlink(outside, filepath.Join(dir, "outdir")))
-	require.NoError(t, os.Symlink("raw", filepath.Join(dir, "indir")))
-	require.NoError(t, os.Symlink(filepath.Join("raw", "v.md"), filepath.Join(dir, "log.md")))
-	require.NoError(t, syscall.Mkfifo(filepath.Join(dir, "f.md"), 0o644))
-	b, err := Open(dir)
-	require.NoError(t, err)
-	defer func() { _ = b.Close() }()
-
-	for _, rel := range []string{"outdir/l.md", "indir/v.md", "log.md", "f.md", "raw/../log.md"} {
-		assert.ErrorIs(t, b.AppendRegular(rel, []byte("x")), ErrNotRegular, rel)
-	}
-	ents, _ := os.ReadDir(outside)
-	assert.Empty(t, ents)
-	got, _ := os.ReadFile(filepath.Join(dir, "raw", "v.md"))
-	assert.Equal(t, "untouched", string(got))
-
-	require.NoError(t, b.AppendRegular("logs/a.md", []byte("one\n")), "positive control: create")
-	require.NoError(t, b.AppendRegular("logs/a.md", []byte("two\n")), "positive control: append")
-	got, _ = os.ReadFile(filepath.Join(dir, "logs", "a.md"))
-	assert.Equal(t, "one\ntwo\n", string(got))
-}
-
-func TestRealParentRefusesASymlinkedDirectoryOrUncleanPath(t *testing.T) {
-	dir := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "raw"), 0o755))
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "wiki"), 0o755))
-	require.NoError(t, os.Symlink(filepath.Join("..", "raw"), filepath.Join(dir, "wiki", "alias")))
-	b, err := Open(dir)
-	require.NoError(t, err)
-	defer func() { _ = b.Close() }()
-	assert.ErrorIs(t, b.RealParent("wiki/alias/x.md"), ErrNotRegular)
-	assert.ErrorIs(t, b.RealParent("wiki/../raw/x.md"), ErrNotRegular)
-	assert.NoError(t, b.RealParent("wiki/x.md"), "positive control")
-}
-
-// cleanRel must refuse an unclean path on its own: here the ".." resolves,
-// after a symlinked directory, to a real regular file, so only the clean
-// check stands between the call and that file.
-func TestAppendRegularRefusesAnUncleanPathThatResolvesToARealFile(t *testing.T) {
-	dir := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "raw", "keep"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "raw", "v.md"), []byte("untouched"), 0o644))
-	require.NoError(t, os.Symlink(filepath.Join("raw", "keep"), filepath.Join(dir, "indir")))
-	b, err := Open(dir)
-	require.NoError(t, err)
-	defer func() { _ = b.Close() }()
-	assert.ErrorIs(t, b.AppendRegular("indir/../v.md", []byte("x")), ErrNotRegular)
-	assert.ErrorIs(t, b.PutRegular("indir/../v.md", []byte("x")), ErrNotRegular)
-	got, _ := os.ReadFile(filepath.Join(dir, "raw", "v.md"))
-	assert.Equal(t, "untouched", string(got))
-}
-
-func TestRemoveRefusesAPathBehindASymlinkedDirectoryAndRemovesOnlyTheLink(t *testing.T) {
-	dir := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "raw"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "raw", "v.md"), []byte("keep"), 0o644))
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "wiki"), 0o755))
-	require.NoError(t, os.Symlink(filepath.Join("..", "raw"), filepath.Join(dir, "wiki", "alias")))
-	require.NoError(t, os.Symlink(filepath.Join("..", "raw", "v.md"), filepath.Join(dir, "wiki", "link.md")))
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "wiki", "n.md"), []byte("n"), 0o644))
-	b, err := Open(dir)
-	require.NoError(t, err)
-	defer func() { _ = b.Close() }()
-
-	assert.ErrorIs(t, b.Remove("wiki/alias/v.md"), ErrNotRegular)
-	_, err = os.Stat(filepath.Join(dir, "raw", "v.md"))
-	assert.NoError(t, err, "the file behind the symlinked directory is kept")
-	require.NoError(t, b.Remove("wiki/link.md"))
-	_, err = os.Stat(filepath.Join(dir, "raw", "v.md"))
-	assert.NoError(t, err, "removing a final symlink never removes its target")
-	require.NoError(t, b.Remove("wiki/n.md"), "positive control")
-	_, err = os.Stat(filepath.Join(dir, "wiki", "n.md"))
-	assert.True(t, os.IsNotExist(err))
-}
-
-// CreateRegular is the only write path for promote and reject: it creates
-// missing parents through the root, refuses an in-brain symlinked parent and
-// an unclean path, and never replaces anything already there (fs.ErrExist,
-// content unchanged), including a dangling link.
-func TestCreateRegularCreatesOnlyNewFilesThroughRealDirectories(t *testing.T) {
-	dir := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "raw", "keep"), 0o755))
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "wiki"), 0o755))
-	require.NoError(t, os.Symlink(filepath.Join("..", "raw"), filepath.Join(dir, "wiki", "inwing")))
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "raw", "v.md"), []byte("untouched"), 0o644))
-	require.NoError(t, os.Symlink(filepath.Join("raw", "keep"), filepath.Join(dir, "indir")))
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "wiki", "exists.md"), []byte("original"), 0o644))
-	require.NoError(t, os.Symlink("nowhere.md", filepath.Join(dir, "wiki", "dangling.md")))
-	b, err := Open(dir)
-	require.NoError(t, err)
-	defer func() { _ = b.Close() }()
-
-	assert.ErrorIs(t, b.CreateRegular("wiki/inwing/facts/n.md", []byte("x")), ErrNotRegular)
-	_, err = os.Stat(filepath.Join(dir, "raw", "facts"))
-	assert.True(t, os.IsNotExist(err), "nothing created through the in-brain link")
-	assert.ErrorIs(t, b.CreateRegular("indir/../v.md", []byte("x")), ErrNotRegular)
-	got, _ := os.ReadFile(filepath.Join(dir, "raw", "v.md"))
-	assert.Equal(t, "untouched", string(got))
-
-	assert.ErrorIs(t, b.CreateRegular("wiki/exists.md", []byte("x")), fs.ErrExist)
-	got, _ = os.ReadFile(filepath.Join(dir, "wiki", "exists.md"))
-	assert.Equal(t, "original", string(got))
-	assert.ErrorIs(t, b.CreateRegular("wiki/dangling.md", []byte("x")), fs.ErrExist)
-	_, err = os.Stat(filepath.Join(dir, "wiki", "nowhere.md"))
-	assert.True(t, os.IsNotExist(err), "nothing created at the dangling link's target")
-
-	require.NoError(t, b.CreateRegular("wiki/new/facts/n.md", []byte("one")), "positive control: create with missing parents")
-	got, _ = os.ReadFile(filepath.Join(dir, "wiki", "new", "facts", "n.md"))
-	assert.Equal(t, "one", string(got))
-}
-
-// hyperguild#192: OpenLock creates or reuses a regular lock file through the
-// root and refuses every other shape without creating anything at a link's
-// target or hanging.
-func TestOpenLockOpensOnlyARegularLockThroughRealDirectories(t *testing.T) {
-	dir := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "raw"), 0o755))
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "wiki", "w"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "raw", "v.md"), []byte("untouched"), 0o644))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "raw", "created"), filepath.Join(dir, "wiki", "w", "dangling.lock")))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "raw", "v.md"), filepath.Join(dir, "wiki", "w", "live.lock")))
-	require.NoError(t, syscall.Mkfifo(filepath.Join(dir, "wiki", "w", "fifo.lock"), 0o644))
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "wiki", "w", "dir.lock"), 0o755))
-	require.NoError(t, os.Symlink(filepath.Join("..", "raw"), filepath.Join(dir, "wiki", "alias")))
-	b, err := Open(dir)
-	require.NoError(t, err)
-	defer func() { _ = b.Close() }()
-
-	for _, rel := range []string{"wiki/w/dangling.lock", "wiki/w/live.lock", "wiki/w/fifo.lock", "wiki/w/dir.lock", "wiki/alias/x.lock", "wiki/w/../w/x.lock"} {
-		done := make(chan error, 1)
-		go func() {
-			f, err := b.OpenLock(rel)
-			if f != nil {
-				_ = f.Close()
-			}
-			done <- err
-		}()
-		select {
-		case err := <-done:
-			assert.ErrorIs(t, err, ErrNotRegular, rel)
-		case <-time.After(3 * time.Second):
-			t.Fatalf("OpenLock hung on %s", rel)
-		}
-	}
-	_, err = os.Lstat(filepath.Join(dir, "raw", "created"))
-	assert.True(t, os.IsNotExist(err), "nothing created at the dangling link's target")
-	got, _ := os.ReadFile(filepath.Join(dir, "raw", "v.md"))
-	assert.Equal(t, "untouched", string(got))
-
-	f, err := b.OpenLock("wiki/w/n.md.lock")
-	require.NoError(t, err, "positive control: creates a lock")
-	assert.True(t, b.LockIsCurrent("wiki/w/n.md.lock", f))
-	require.NoError(t, b.Remove("wiki/w/n.md.lock"))
-	assert.False(t, b.LockIsCurrent("wiki/w/n.md.lock", f), "a removed lock is no longer current")
-	_ = f.Close()
-}
@@ -1,173 +0,0 @@
-// Package brainfstest is the shared harness for hyperguild#157's swap-race
-// tests: it keeps swapping a regular note, a symlink to a sentinel target file
-// (outside the brain, or inside it for hyperguild#171), or a FIFO (with a
-// writer held open) into a path while a reader under test loops.
-// It observes two things, over a sampled window only: no sentinel byte from
-// the target reaches the reader's output, and the reader returns within a
-// timeout. It does not cover
-// hard links, other paths into the reader, or races it does not generate.
-package brainfstest
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"syscall"
-	"testing"
-	"time"
-)
-
-// Sentinel marks the target file's contents.
-const Sentinel = "zqbrainfssentinelonefiftyseven"
-
-// outsideContent carries Sentinel in every field a reader might extract: the
-// frontmatter title and aliases, a heading, a wikilink and the body.
-const outsideContent = "---\ntitle: " + Sentinel + "\naliases:\n  - " + Sentinel + "\n---\n# " + Sentinel +
-	"\n\n" + Sentinel + " [[" + Sentinel + "]]\n"
-
-// Outside writes a file outside any brain dir containing Sentinel.
-func Outside(t testing.TB) string {
-	t.Helper()
-	p := filepath.Join(t.TempDir(), "secret.md")
-	if err := os.WriteFile(p, []byte(outsideContent), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	return p
-}
-
-var swapSeq atomic.Int64
-
-// StartSwap renames, in a loop, a regular note (content inside) and either
-// a symlink to outside or a FIFO into path, until the test ends. FIFOs get a
-// writer held open until the swapper exits, so a reader that skips the
-// handle check parks forever instead of reading EOF. The swapper is stopped
-// and awaited before t.TempDir cleanup. It returns the number of symlinks
-// or FIFOs actually renamed into path so far, so a caller can tell a race
-// that ran from one whose every swap failed (hyperguild#177).
-func StartSwap(t testing.TB, path, inside, outside string, fifo bool) *atomic.Int64 {
-	t.Helper()
-	var swaps atomic.Int64
-	var stop atomic.Bool
-	var wg sync.WaitGroup
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
-		// A name of its own: swappers on one path share a test, and one
-		// opening another's FIFO for write would block forever.
-		tmp := fmt.Sprintf("%s.swap%d", path, swapSeq.Add(1))
-		// A relative link: os.Root refuses every absolute link on its own, so
-		// an absolute in-brain target would test nothing.
-		link := outside
-		if rel, err := filepath.Rel(filepath.Dir(path), outside); err == nil {
-			link = rel
-		}
-		var writers []*os.File
-		defer func() {
-			for _, w := range writers {
-				_ = w.Close()
-			}
-		}()
-		for i := 0; !stop.Load(); i++ {
-			_ = os.Remove(tmp)
-			var made error
-			switch {
-			case i%2 == 0:
-				_ = os.WriteFile(tmp, []byte(inside), 0o644)
-			case fifo:
-				if made = syscall.Mkfifo(tmp, 0o644); made == nil {
-					if w, err := os.OpenFile(tmp, os.O_RDWR, 0); err == nil {
-						writers = append(writers, w)
-					}
-				}
-			default:
-				made = os.Symlink(link, tmp)
-			}
-			if err := os.Rename(tmp, path); err == nil && made == nil && i%2 == 1 {
-				swaps.Add(1)
-			}
-		}
-	}()
-	t.Cleanup(func() { stop.Store(true); wg.Wait() })
-	return &swaps
-}
-
-// WriteSentinelAt writes a file carrying Sentinel at p (creating its
-// directory), for an in-brain symlink target.
-func WriteSentinelAt(t *testing.T, p string) string {
-	t.Helper()
-	if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(p, []byte(outsideContent), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	return p
-}
-
-// AssertNoLeak loops read for d while a symlink swapper runs on path, and
-// fails if any output contains Sentinel. The symlink points outside the
-// brain; os.Root refuses that on its own, so pair it with AssertNoLeakFrom
-// and an in-brain target.
-func AssertNoLeak(t *testing.T, path, inside string, d time.Duration, read func() string) {
-	t.Helper()
-	AssertNoLeakFrom(t, path, inside, Outside(t), d, read)
-}
-
-// InsideMarker must appear in the inside note's content and in read's
-// output whenever read saw that note: the floor below counts such reads.
-const InsideMarker = "inside"
-
-// AssertNoLeakFrom is AssertNoLeak with the symlink pointing at target, e.g.
-// a file elsewhere in the brain written with WriteSentinelAt.
-//
-// Beyond "no Sentinel in any output" it sets two floors, because without
-// them the assertion passes when nothing was tested (hyperguild#177): at
-// least one symlink must have been swapped into path, and at least one read
-// must have returned InsideMarker (a reader that always errors returns
-// nothing, and so never leaks).
-func AssertNoLeakFrom(t testing.TB, path, inside, target string, d time.Duration, read func() string) {
-	t.Helper()
-	if !strings.Contains(inside, InsideMarker) {
-		t.Fatalf("inside content must contain %q", InsideMarker)
-	}
-	swaps := StartSwap(t, path, inside, target, false)
-	leaks, iters, insideReads := 0, 0, 0
-	for deadline := time.Now().Add(d); time.Now().Before(deadline); iters++ {
-		out := read()
-		leaks += strings.Count(out, Sentinel)
-		if strings.Contains(out, InsideMarker) {
-			insideReads++
-		}
-	}
-	if leaks > 0 {
-		t.Fatalf("symlink target %s leaked %d times in %d iterations", target, leaks, iters)
-	}
-	if n := swaps.Load(); n == 0 {
-		t.Fatalf("no symlink was swapped into %s in %d iterations: the race did not run", path, iters)
-	}
-	if insideReads == 0 {
-		t.Fatalf("no read in %d iterations returned the inside note (%q): the reader read nothing", iters, InsideMarker)
-	}
-}
-
-// AssertNoHang loops read for d while a FIFO swapper (held writers) runs on
-// path, and fails if a read does not return within timeout.
-func AssertNoHang(t *testing.T, path, inside string, d, timeout time.Duration, read func()) {
-	t.Helper()
-	StartSwap(t, path, inside, Outside(t), true)
-	done := make(chan struct{})
-	go func() {
-		for deadline := time.Now().Add(d); time.Now().Before(deadline); {
-			read()
-		}
-		close(done)
-	}()
-	select {
-	case <-done:
-	case <-time.After(timeout):
-		t.Fatal("reader hung on a swapped-in FIFO with a writer held open")
-	}
-}
@@ -1,79 +0,0 @@
-package brainfstest
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"runtime"
-	"syscall"
-	"testing"
-	"time"
-)
-
-// recordingTB stands in for the test under AssertNoLeakFrom so a fatal
-// there can be observed instead of failing this test. Fatalf ends the
-// calling goroutine the way testing.T does.
-type recordingTB struct {
-	testing.TB
-	failed bool
-	msg    string
-}
-
-func (r *recordingTB) Fatalf(format string, args ...any) {
-	r.failed, r.msg = true, fmt.Sprintf(format, args...)
-	runtime.Goexit()
-}
-
-func runAssert(t *testing.T, path, target string, read func() string) *recordingTB {
-	t.Helper()
-	r := &recordingTB{TB: t}
-	done := make(chan struct{})
-	go func() {
-		defer close(done)
-		AssertNoLeakFrom(r, path, "inside", target, 200*time.Millisecond, read)
-	}()
-	<-done
-	return r
-}
-
-// hyperguild#177: with every swap failing, no leak can occur, so the leak
-// assertion passed without testing anything.
-func TestAssertNoLeakFromFailsWhenNoSymlinkSwapSucceeds(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "missing-dir", "r.md")
-	r := runAssert(t, path, Outside(t), func() string { return "inside" })
-	if !r.failed {
-		t.Fatal("AssertNoLeakFrom passed with zero successful symlink swaps")
-	}
-}
-
-// hyperguild#177: a reader that always errors returns nothing, so it never
-// leaks either.
-func TestAssertNoLeakFromFailsWhenNoReadReturnsTheInsideNote(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "r.md")
-	r := runAssert(t, path, Outside(t), func() string { return "" })
-	if !r.failed {
-		t.Fatal("AssertNoLeakFrom passed with zero reads returning the inside note")
-	}
-}
-
-// Positive control: a reader that refuses symlinks and reads regular files
-// passes, so the floors do not fail a working reader.
-func TestAssertNoLeakFromPassesAReaderThatRefusesSymlinks(t *testing.T) {
-	path := filepath.Join(t.TempDir(), "r.md")
-	read := func() string {
-		f, err := os.OpenFile(path, os.O_RDONLY|noFollow, 0)
-		if err != nil {
-			return ""
-		}
-		defer func() { _ = f.Close() }()
-		b := make([]byte, 64)
-		n, _ := f.Read(b)
-		return string(b[:n])
-	}
-	r := runAssert(t, path, Outside(t), read)
-	if r.failed {
-		t.Fatalf("a symlink-refusing reader failed: %s", r.msg)
-	}
-}
-
-const noFollow = syscall.O_NOFOLLOW
@@ -49,12 +49,10 @@ func (s *Store) Write(ctx context.Context, n capture.Note) (capture.Ref, error)
 	n.Content = content

 	relPath, err := api.WriteNote(s.brainDir, api.WriteNoteOptions{
-		Content:   n.Content,
-		Filename:  n.Filename,
-		Wing:      n.Wing,
-		Hall:      n.Hall,
-		Origin:    n.Origin,
-		WrittenBy: n.WrittenBy,
+		Content:  n.Content,
+		Filename: n.Filename,
+		Wing:     n.Wing,
+		Hall:     n.Hall,
 	})
 	if err != nil {
 		return capture.Ref{}, err
@@ -76,7 +74,7 @@ func (s *Store) Update(ctx context.Context, slug string, n capture.Note) (captur
 	}
 	n.Content = content

-	opts := api.UpdateNoteOptions{Content: n.Content, Reason: n.Reason, Origin: n.Origin, WrittenBy: n.WrittenBy}
+	opts := api.UpdateNoteOptions{Content: n.Content, Reason: n.Reason}
 	if strings.Contains(slug, "/") {
 		opts.Path = slug
 	} else {
@@ -60,7 +60,6 @@ type CaptureContext struct {
 	Classification string // caller-declared level token ("" = unspecified)
 	Principal      string // server-derived (auth); audit identity
 	Origin         Zone   // server-derived trust zone; the I1 gate input
-	AuthPath       string // server-derived: "static" or "jwt"; stamped as note provenance (#145)
 }

 // Insight is one piece of session knowledge bound for the brain. A
@@ -40,11 +40,6 @@ type Note struct {
 	Wing     string
 	Hall     string
 	Reason   string
-	// Provenance (hyperguild#145) is stamped by the server from the
-	// authenticated principal, never taken from Content's frontmatter.
-	// Origin is "static", "jwt" or "unknown"; empty means "unknown".
-	Origin    string
-	WrittenBy string
 }

 // BrainStore is the brain persistence port — the shared implementation of
@@ -142,7 +142,7 @@ func (s *Service) Capture(ctx context.Context, in CaptureInput) (CaptureReceipt,
 	var landed []string

 	for i, ins := range in.Insights {
-		res, item, err := s.persistInsight(ctx, ins, in.Context)
+		res, item, err := s.persistInsight(ctx, ins)
 		receipt.Insights = append(receipt.Insights, res)
 		if err != nil {
 			receipt.Errors = append(receipt.Errors, ItemError{Item: fmt.Sprintf("insight[%d]", i), Error: err.Error()})
@@ -278,11 +278,8 @@ func escalationReason(escalators []string) string {
 	return "required by: " + strings.Join(escalators, ", ")
 }

-func (s *Service) persistInsight(ctx context.Context, ins Insight, cc CaptureContext) (InsightResult, string, error) {
-	note := Note{
-		Content: ins.Text, Wing: ins.Wing, Hall: ins.Hall, Filename: brain.Sanitise(firstLine(ins.Text)),
-		Origin: cc.AuthPath, WrittenBy: cc.Principal,
-	}
+func (s *Service) persistInsight(ctx context.Context, ins Insight) (InsightResult, string, error) {
+	note := Note{Content: ins.Text, Wing: ins.Wing, Hall: ins.Hall, Filename: brain.Sanitise(firstLine(ins.Text))}
 	var ref Ref
 	var err error
 	if ins.SupersedeSlug != "" {
@@ -104,10 +104,6 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	// caller may have tried to put in the body.
 	in.Context.Principal = principal
 	in.Context.Origin = h.resolver.Resolve(principal, viaStatic)
-	in.Context.AuthPath = "jwt"
-	if viaStatic {
-		in.Context.AuthPath = "static"
-	}

 	rec, err := h.svc.Capture(r.Context(), in)
 	switch {
@@ -1,51 +0,0 @@
-package capturehttp_test
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/audit"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainstore"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/capture"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/capturehttp"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/classification"
-)
-
-// The REST capture door derives AuthPath itself (hyperguild#145); a body
-// field cannot set it, and static vs JWT are told apart.
-func TestRESTCaptureStampsAuthPathFromAuthentication(t *testing.T) {
-	for _, tc := range []struct {
-		name, authz, wantOrigin, wantBy string
-		v                               capturehttp.Validator
-		sovereign                       []string
-	}{
-		{"static", "Bearer " + staticTok, "origin: static\n", "written_by: local-cli\n", nil, nil},
-		{"jwt", "Bearer jwt", "origin: jwt\n", "written_by: koala-cli\n", fakeValidator{subject: "koala-cli"}, []string{"koala-cli"}},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			brainDir := t.TempDir()
-			cfg, err := classification.Load(t.TempDir())
-			require.NoError(t, err)
-			svc := capture.NewService(brainstore.New(brainDir), fakeTracker{}, cfg, audit.NewSlogSink(nil))
-			h := capturehttp.New(svc, tc.v, staticTok, "local-cli", capturehttp.NewOriginResolver(tc.sovereign))
-			rr := do(t, h, tc.authz, map[string]any{
-				"context": map[string]any{
-					"harness": "claude-code", "actor": "mathias", "classification": "internal",
-					"AuthPath": "static", "auth_path": "static", "principal": "local-cli",
-				},
-				"insights": []map[string]any{{"text": "rest provenance probe", "wing": "hyperguild", "hall": "facts"}},
-			})
-			require.Equal(t, 200, rr.Code, rr.Body.String())
-			matches, _ := filepath.Glob(filepath.Join(brainDir, "wiki/hyperguild/facts/*.md"))
-			require.Len(t, matches, 1)
-			b, err := os.ReadFile(matches[0])
-			require.NoError(t, err)
-			assert.Contains(t, string(b), tc.wantOrigin)
-			assert.Contains(t, string(b), tc.wantBy)
-		})
-	}
-}
@@ -16,10 +16,9 @@
 package classification

 import (
-	"errors"
 	"fmt"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
-	"io/fs"
+	"os"
+	"path/filepath"
 	"strings"

 	"gopkg.in/yaml.v3"
@@ -111,20 +110,9 @@ type rawConfig struct {
 func Load(brainDir string) (*Config, error) {
 	cfg := &Config{wings: map[string]Level{}, repos: map[string]Level{}}

-	// Read through the brain root, regular files only (hyperguild#157): a
-	// symlinked or special file is not trusted as the config, which is a hard
-	// error like a malformed one.
-	bfs, err := brainfs.Open(brainDir)
-	if errors.Is(err, fs.ErrNotExist) {
-		return cfg, nil
-	}
+	data, err := os.ReadFile(filepath.Join(brainDir, "classification.yaml"))
 	if err != nil {
-		return nil, fmt.Errorf("open brain: %w", err)
-	}
-	defer func() { _ = bfs.Close() }()
-	data, err := bfs.ReadRegular("classification.yaml")
-	if err != nil {
-		if errors.Is(err, fs.ErrNotExist) {
+		if os.IsNotExist(err) {
 			return cfg, nil
 		}
 		return nil, fmt.Errorf("read classification.yaml: %w", err)
@@ -1,46 +0,0 @@
-package classification
-
-import (
-	"os"
-	"path/filepath"
-	"syscall"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// hyperguild#157 slice 6: Load read classification.yaml with os.ReadFile. It
-// sets the I1 sovereignty levels; a symlinked file must not be trusted as the
-// config (a hard error, as for a malformed file), and a FIFO must not hang
-// startup.
-func TestLoadRefusesASymlinkedOrFIFOClassificationFile(t *testing.T) {
-	ok := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(ok, "classification.yaml"), []byte("wings:\n  w: confidential\n"), 0o644))
-	_, err := Load(ok)
-	require.NoError(t, err, "positive control")
-
-	linked := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(linked, "real.yaml"), []byte("wings:\n  w: public\n"), 0o644))
-	require.NoError(t, os.Symlink("real.yaml", filepath.Join(linked, "classification.yaml")))
-	_, err = Load(linked)
-	assert.Error(t, err, "an in-brain symlink is not trusted as the config")
-
-	fifo := t.TempDir()
-	require.NoError(t, syscall.Mkfifo(filepath.Join(fifo, "classification.yaml"), 0o644))
-	w, err := os.OpenFile(filepath.Join(fifo, "classification.yaml"), os.O_RDWR, 0)
-	require.NoError(t, err)
-	defer func() { _ = w.Close() }()
-	done := make(chan error, 1)
-	go func() { _, err := Load(fifo); done <- err }()
-	select {
-	case err := <-done:
-		assert.Error(t, err)
-	case <-time.After(3 * time.Second):
-		t.Fatal("Load hung on a FIFO")
-	}
-
-	_, err = Load(t.TempDir())
-	assert.NoError(t, err, "an absent file is still not an error")
-}
@@ -43,26 +43,6 @@ var DefaultRules = []Rule{
 	// JSON, so both segments begin with "eyJ".
 	{Name: "jwt", RE: regexp.MustCompile(`eyJ[A-Za-z0-9_\-]{8,}\.eyJ[A-Za-z0-9_\-]{8,}\.[A-Za-z0-9_\-]{8,}`)},
 	{Name: "postgres-uri-with-password", RE: regexp.MustCompile(`postgres(?:ql)?://[^:\s/]+:[^@\s/]+@`)},
-	// Any credential embedded in a URL's userinfo, which is what a git credential
-	// store holds: `https://<user>:<token>@host`. The postgres rule above is the
-	// same shape narrowed to one scheme, and is kept ahead of this one only so a
-	// DSN reports the more specific name -- same ordering convention as
-	// authorization-header before bearer-token.
-	//
-	// Added after this shape passed ALL rules and was therefore ingested rather
-	// than dropped (hyperguild#142). It reached ~/.claude/projects -- this
-	// watcher's own input -- because a test suite in mathias/infra executed a
-	// script that configures git while inheriting the operator's real $HOME, read
-	// koala's live credential store, and printed it. Two credentials were rotated
-	// (infra#466). The scrubber is the control that decides whether that class of
-	// mistake is survivable, and for this shape it was failing open.
-	//
-	// The {8,} floor on the secret half is what keeps `https://host:443/path` and
-	// `https://user:@host` out; the `[^:\s/@]+` user half stops a host:port pair
-	// being read as userinfo. Both directions are covered by
-	// TestScrub_URLUserinfoCredential, because a rule that dropped every URL with
-	// a colon in it would discard most of the signal this watcher exists to keep.
-	{Name: "url-userinfo-credential", RE: regexp.MustCompile(`[a-zA-Z][a-zA-Z0-9+.\-]*://[^:\s/@]+:[^@\s/]{8,}@`)},
 	{Name: "private-key", RE: regexp.MustCompile(`-----BEGIN[^-]*PRIVATE KEY-----`)},
 	{Name: "ssh-key", RE: regexp.MustCompile(`ssh-(?:rsa|ed25519|ecdsa)\s+[A-Za-z0-9+/=]{40,}`)},
 	{Name: "github-pat", RE: regexp.MustCompile(`\b(?:ghp|gho|ghu|ghr|gha)_[A-Za-z0-9]{30,}\b`)},
@@ -46,64 +46,6 @@ func TestScrub_PoisonedFixtures(t *testing.T) {
 	}
 }

-// A credential embedded in a URL's userinfo is the shape a git credential store
-// holds -- `https://<user>:<token>@host` -- and it walked past every rule until
-// hyperguild#142. There was a rule for `postgres://user:pass@` and nothing for the
-// general form, so `~/.git-credentials` content was ingested rather than dropped.
-//
-// Found the hard way: a test suite in mathias/infra executed a script that
-// configures git while inheriting the operator's real $HOME, read koala's live
-// credential store, and printed two live credentials into a session transcript.
-// ~/.claude/projects is this watcher's own input, so the scrubber was the last
-// line of defence for that mistake and it failed open. Two credentials were
-// rotated (infra#466).
-//
-// The lesson is not "do not read the credential file" -- that mistake will recur.
-// It is that this shape must fail closed, because the scrubber is what decides
-// whether such a mistake is survivable.
-func TestScrub_URLUserinfoCredential(t *testing.T) {
-	// Every secret below is INVENTED. None is or was a real credential.
-	mustScrub := []struct {
-		name    string
-		content string
-	}{
-		{"git-credential-store-user", "https://mathias:0123456789abcdef0123456789abcdef01234567@git.d-ma.be"},
-		{"git-credential-store-oauth2", "https://oauth2:0123456789abcdef0123456789abcdef01234567@git.d-ma.be"},
-		{"in-context-payload-line", `payload line: https://mathias:0123456789abcdef0123456789abcdef01234567@git.d-ma.be`},
-		{"clone-url-in-argv", "git clone https://oauth2:abcdefghijklmnopqrstuvwx@git.d-ma.be/mathias/infra.git"},
-		{"http-not-https", "http://admin:supersecretvalue123@10.0.1.20/api"},
-		{"git-plus-ssh-scheme", "git+ssh://deploy:abcdefghijklmnop@example.com/repo"},
-		{"redis-scheme", "redis://default:abcdefghijklmnopqrst@10.0.1.20:6379/0"},
-	}
-	for _, tc := range mustScrub {
-		t.Run(tc.name, func(t *testing.T) {
-			assert.NotEmpty(t, Scrub(tc.content),
-				"a credential in URL userinfo must be dropped, not ingested")
-		})
-	}
-
-	// The other direction matters as much: a rule that scrubs every URL with a
-	// colon in it would drop most of the signal this watcher exists to keep.
-	mustNotScrub := []struct {
-		name    string
-		content string
-	}{
-		{"host-with-port", "cloning https://git.d-ma.be:443/mathias/infra.git"},
-		{"postgres-no-password", "postgres://localhost:5432/brain"},
-		{"url-with-colon-in-query", "GET https://example.com/path?filter=a:b&x=1"},
-		{"plain-url", "see https://git.d-ma.be/mathias/infra/issues/466"},
-		{"userinfo-no-secret", "https://user:@example.com"},
-		{"format-string-placeholder", `printf 'https://oauth2:%s@%s\n' "$TOKEN" "$HOST"`},
-		{"scheme-relative-time", "duration https://example.com took 00:03:22"},
-	}
-	for _, tc := range mustNotScrub {
-		t.Run(tc.name, func(t *testing.T) {
-			assert.Empty(t, Scrub(tc.content),
-				"this is not a credential and must pass through")
-		})
-	}
-}
-
 func TestScrub_CleanContentPassesThrough(t *testing.T) {
 	cases := []string{
 		"",
@@ -1,130 +0,0 @@
-package extract
-
-import (
-	"go/ast"
-	"go/parser"
-	"go/token"
-	"os"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"testing"
-)
-
-const extractPkg = "github.com/mathiasbq/hyperguild/ingestion/internal/extract"
-
-// parseNonTest parses every non-test Go file under the module.
-func parseNonTest(t *testing.T) map[string]*ast.File {
-	t.Helper()
-	fset := token.NewFileSet()
-	out := map[string]*ast.File{}
-	err := filepath.WalkDir(filepath.Join("..", ".."), func(p string, d os.DirEntry, err error) error {
-		if err != nil {
-			return err
-		}
-		if d.IsDir() && (d.Name() == "vendor" || d.Name() == ".git") {
-			return filepath.SkipDir
-		}
-		if d.IsDir() || !strings.HasSuffix(p, ".go") || strings.HasSuffix(p, "_test.go") {
-			return nil
-		}
-		f, perr := parser.ParseFile(fset, p, nil, 0)
-		if perr != nil {
-			return perr
-		}
-		out[filepath.ToSlash(p)] = f
-		return nil
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	return out
-}
-
-// PR #156 review: reading a caller-chosen path by name reopens it after the
-// containment check (hyperguild#153 item 3). Outside this package, nothing
-// may reference extract.Text — called OR taken as a value — under whatever
-// name the package is imported (round 2: an alias and a func value slipped
-// past a plain text search).
-func TestNoPackageReferencesExtractTextOutsideExtract(t *testing.T) {
-	for path, f := range parseNonTest(t) {
-		if strings.Contains(path, "internal/extract/") {
-			continue
-		}
-		names := map[string]bool{}
-		for _, imp := range f.Imports {
-			if p, _ := strconv.Unquote(imp.Path.Value); p == extractPkg {
-				name := "extract"
-				if imp.Name != nil {
-					name = imp.Name.Name
-				}
-				if name == "." {
-					t.Errorf("%s dot-imports extract; import it by name so its use stays checkable", path)
-				}
-				names[name] = true
-			}
-		}
-		if len(names) == 0 {
-			continue
-		}
-		ast.Inspect(f, func(n ast.Node) bool {
-			if sel, ok := n.(*ast.SelectorExpr); ok {
-				if id, ok := sel.X.(*ast.Ident); ok && names[id.Name] && sel.Sel.Name == "Text" {
-					t.Errorf("%s references %s.Text; use extract.TextIn through an os.Root", path, id.Name)
-				}
-			}
-			return true
-		})
-	}
-}
-
-// PR #156 review round 2: the FIFO fix (open non-blocking, check the handle)
-// lives in OpenRegular, and reverting any caller to a plain Root.Open stayed
-// green. In the three raw/ reader FILES parsed below (and only those: a
-// wrapper in another file is not seen), no Open/OpenFile/ReadFile selector
-// may appear outside OpenRegular, called or taken as a method value. This is
-// a second layer; the behavioural race tests in internal/api and
-// internal/watcher are what catch a rewrite through any API (round 3).
-// osOpenAllowed names the functions in guarded files that may call os.Open*
-// on a path that is not a raw/ read.
-var osOpenAllowed = map[string]bool{
-	"internal/watcher/watcher.go:appendWatcherLog": true, // ingest log append, not a raw/ read
-	// Text reads by path; outside this package only TextIn's temp copy reaches
-	// it (TestNoPackageReferencesExtractTextOutsideExtract enforces that).
-	"internal/extract/extract.go:Text": true,
-}
-
-func TestRawReaderFilesUseNoOpenOrReadFileOutsideOpenRegular(t *testing.T) {
-	guarded := []string{"internal/api/rawroot.go", "internal/extract/extract.go", "internal/watcher/watcher.go"}
-	files := parseNonTest(t)
-	for _, g := range guarded {
-		var f *ast.File
-		for p, af := range files {
-			if strings.HasSuffix(p, g) {
-				f = af
-			}
-		}
-		if f == nil {
-			t.Fatalf("guarded file %s not found", g)
-		}
-		for _, decl := range f.Decls {
-			fn, ok := decl.(*ast.FuncDecl)
-			if !ok || fn.Name.Name == "OpenRegular" {
-				continue
-			}
-			ast.Inspect(fn, func(n ast.Node) bool {
-				sel, ok := n.(*ast.SelectorExpr)
-				if !ok {
-					return true
-				}
-				if sel.Sel.Name == "Open" || sel.Sel.Name == "OpenFile" || sel.Sel.Name == "ReadFile" {
-					if id, ok := sel.X.(*ast.Ident); ok && id.Name == "os" && osOpenAllowed[g+":"+fn.Name.Name] {
-						return true // a named non-raw write (the ingest log append)
-					}
-					t.Errorf("%s: %s calls .%s; raw/ reads must go through OpenRegular", g, fn.Name.Name, sel.Sel.Name)
-				}
-				return true
-			})
-		}
-	}
-}
@@ -3,10 +3,8 @@ package extract

 import (
 	"fmt"
-	"io"
 	"os"
 	"strings"
-	"syscall"
 )

 // Text reads the file at path and returns its plain-text content.
@@ -43,70 +41,3 @@ func fileExt(path string) string {
 	}
 	return ""
 }
-
-// TextIn is Text for a file read through an os.Root (hyperguild#153): the
-// read cannot leave the root, so a path checked earlier cannot be swapped
-// for a symlink pointing elsewhere before it is read. Formats that need an
-// external tool (pdf, docmark) are copied to a temp file from the handle
-// opened through the root, then extracted from the copy.
-func TextIn(r *os.Root, rel string) (string, error) {
-	fi, err := r.Lstat(rel)
-	if err != nil {
-		return "", fmt.Errorf("stat %s: %w", rel, err)
-	}
-	if !fi.Mode().IsRegular() {
-		return "", fmt.Errorf("%s: not a regular file", rel)
-	}
-	f, _, err := OpenRegular(r, rel)
-	if err != nil {
-		return "", fmt.Errorf("open %s: %w", rel, err)
-	}
-	defer func() { _ = f.Close() }()
-	ext := strings.ToLower(fileExt(rel))
-	switch ext {
-	case ".md", ".txt":
-		b, err := io.ReadAll(f)
-		if err != nil {
-			return "", fmt.Errorf("read %s: %w", rel, err)
-		}
-		return string(b), nil
-	case ".pdf", ".docx", ".xlsx", ".pptx", ".png", ".jpg", ".jpeg":
-		tmp, err := os.CreateTemp("", "ingest-*"+ext)
-		if err != nil {
-			return "", fmt.Errorf("temp copy: %w", err)
-		}
-		defer func() { _ = os.Remove(tmp.Name()) }()
-		if _, err := io.Copy(tmp, f); err != nil {
-			_ = tmp.Close()
-			return "", fmt.Errorf("copy %s: %w", rel, err)
-		}
-		if err := tmp.Close(); err != nil {
-			return "", fmt.Errorf("copy %s: %w", rel, err)
-		}
-		return Text(tmp.Name())
-	default:
-		return "", fmt.Errorf("unsupported file extension: %s", ext)
-	}
-}
-
-// OpenRegular opens rel inside r and returns it only if the OPENED handle is
-// a regular file. The open is non-blocking, so a FIFO swapped in after an
-// Lstat (PR #156 review: it hung open(2) forever) is refused promptly rather
-// than stalling the reader. Callers keep their Lstat check, which refuses
-// symlinks outright; this closes the race between that check and the open.
-func OpenRegular(r *os.Root, rel string) (*os.File, os.FileInfo, error) {
-	f, err := r.OpenFile(rel, os.O_RDONLY|syscall.O_NONBLOCK, 0)
-	if err != nil {
-		return nil, nil, err
-	}
-	fi, err := f.Stat()
-	if err != nil {
-		_ = f.Close()
-		return nil, nil, err
-	}
-	if !fi.Mode().IsRegular() {
-		_ = f.Close()
-		return nil, nil, fmt.Errorf("%s: not a regular file", rel)
-	}
-	return f, fi, nil
-}
@@ -1,64 +0,0 @@
-package extract
-
-import (
-	"os"
-	"path/filepath"
-	"syscall"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// hyperguild#153 item 3: ingest checked a path, then extract.Text reopened it
-// by name, so a file swapped for a symlink in between was followed out of
-// raw/. TextIn reads through an os.Root, which refuses to leave the root.
-func TestTextInReadsInsideTheRootAndRefusesEscapes(t *testing.T) {
-	root := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(root, "ok.md"), []byte("inside"), 0o644))
-	outside := filepath.Join(t.TempDir(), "secret.md")
-	require.NoError(t, os.WriteFile(outside, []byte("SENTINEL-153-TEXTIN"), 0o644))
-	require.NoError(t, os.Symlink(outside, filepath.Join(root, "leak.md")))
-
-	r, err := os.OpenRoot(root)
-	require.NoError(t, err)
-	defer func() { _ = r.Close() }()
-
-	got, err := TextIn(r, "ok.md")
-	require.NoError(t, err)
-	assert.Equal(t, "inside", got)
-
-	got, err = TextIn(r, "leak.md")
-	assert.Error(t, err)
-	assert.NotContains(t, got, "SENTINEL-153-TEXTIN")
-
-	_, err = TextIn(r, "../"+filepath.Base(outside))
-	assert.Error(t, err)
-}
-
-// PR #156 review: a regular file swapped for a FIFO between Lstat and Open
-// blocked open(2) forever. OpenRegular opens non-blocking and checks the type
-// on the opened handle, so a FIFO is refused promptly instead of hanging.
-func TestOpenRegularRefusesAFIFOWithoutBlocking(t *testing.T) {
-	dir := t.TempDir()
-	require.NoError(t, syscall.Mkfifo(filepath.Join(dir, "pipe.md"), 0o644))
-	r, err := os.OpenRoot(dir)
-	require.NoError(t, err)
-	defer func() { _ = r.Close() }()
-
-	done := make(chan error, 1)
-	go func() {
-		f, _, err := OpenRegular(r, "pipe.md")
-		if f != nil {
-			_ = f.Close()
-		}
-		done <- err
-	}()
-	select {
-	case err := <-done:
-		assert.Error(t, err)
-	case <-time.After(2 * time.Second):
-		t.Fatal("OpenRegular blocked on a FIFO")
-	}
-}
@@ -66,7 +66,7 @@ func Fix(doc []byte) ([]byte, bool, error) {
 		return doc, false, fmt.Errorf("frontmatter: quoting did not repair the block: %w", err)
 	}

-	_, rest, _ := Split(doc)
+	_, rest, _ := split(doc)
 	out := []byte(fence + "\n")
 	out = append(out, fixed...)
 	out = append(out, []byte(fence)...)
@@ -122,25 +122,14 @@ func needsQuoting(value string) bool {

 // block returns the raw YAML between the opening and closing fences.
 func block(doc []byte) ([]byte, bool) {
-	b, _, ok := Split(doc)
+	b, _, ok := split(doc)
 	return b, ok
 }

-// Split returns doc's frontmatter block and everything from the closing
-// fence onward (the closing fence itself excluded, its trailing newline
-// included), or ok=false if doc has no properly-fenced frontmatter.
-//
-// The canonical fence detector for this codebase (hyperguild#138): three
-// independent reimplementations of this same logic each grew their own gap
-// through separate bug-fixing before being consolidated here —
-// internal/mcp's needed a CRLF/BOM guard added after both silently defeated
-// its own HasPrefix check, and internal/api's closing-fence match had no
-// trailing-newline requirement, so a document ending in "\n---extra" with no
-// real newline after the fence was treated as validly closed. Both classes
-// are closed here, once, for every caller.
-func Split(doc []byte) (block, rest []byte, ok bool) {
-	s := strings.TrimPrefix(string(doc), "\xef\xbb\xbf")
-	s = strings.ReplaceAll(s, "\r\n", "\n")
+// split returns the frontmatter block and everything from the closing fence
+// onward (the closing fence itself excluded, its trailing newline included).
+func split(doc []byte) (block, rest []byte, ok bool) {
+	s := string(doc)
 	if !strings.HasPrefix(s, fence+"\n") {
 		return nil, nil, false
 	}
@@ -150,18 +139,5 @@ func Split(doc []byte) (block, rest []byte, ok bool) {
 	if idx < 0 {
 		return nil, nil, false
 	}
-	// What follows the closing fence must be either a newline (a real body
-	// follows) or nothing at all (the fence is the literal end of the
-	// document — no body, not a bypass attempt). Anything else, e.g.
-	// "\n---extra", is not a valid close: an earlier version of this check
-	// accepted it, which is exactly the looser match hyperguild#138 closes.
-	after := idx + 1 + len(fence)
-	switch {
-	case after == len(body):
-		return []byte(body[:idx+1]), nil, true
-	case body[after] == '\n':
-		return []byte(body[:idx+1]), []byte(body[after:]), true
-	default:
-		return nil, nil, false
-	}
+	return []byte(body[:idx+1]), []byte(body[idx+1+len(fence):]), true
 }
@@ -168,9 +168,9 @@ func TestFix_PreservesBodyExactly(t *testing.T) {
 	require.True(t, changed)
 	assert.True(t, len(got) > 0)

-	_, rest, ok := Split([]byte(doc))
+	_, rest, ok := split([]byte(doc))
 	require.True(t, ok)
-	_, gotRest, ok := Split(got)
+	_, gotRest, ok := split(got)
 	require.True(t, ok)
 	assert.Equal(t, string(rest), string(gotRest), "the body must not be touched")
 }
@@ -186,55 +186,3 @@ func TestFix_RefusesToReturnAnUnparseableResult(t *testing.T) {
 	assert.False(t, changed)
 	assert.Equal(t, doc, string(got), "an unfixable document must come back byte-identical")
 }
-
-// TestSplit_NormalizesCRLFBeforeFenceDetection is hyperguild#138: a note
-// whose fence lines use CRLF ("---\r\n") failed strings.HasPrefix(doc,
-// "---\n") on the precondition read in internal/mcp's independent
-// reimplementation -- encoding alone, no adversarial input, silently
-// defeated fence detection there before this consolidation. Split must
-// never repeat that.
-func TestSplit_NormalizesCRLFBeforeFenceDetection(t *testing.T) {
-	doc := "---\r\ntitle: 'n'\r\nhalf_life: durable\r\n---\r\n\r\nbody\r\n"
-	block, rest, ok := Split([]byte(doc))
-	require.True(t, ok)
-	assert.Contains(t, string(block), "half_life: durable")
-	assert.Contains(t, string(rest), "body")
-}
-
-// TestSplit_StripsALeadingUTF8BOM is the same mechanism one layer earlier:
-// a leading BOM (Notepad's default "UTF-8" save, PowerShell's pre-v6
-// Out-File/Set-Content) defeats the same HasPrefix check before CRLF
-// normalization even applies.
-func TestSplit_StripsALeadingUTF8BOM(t *testing.T) {
-	doc := "\xef\xbb\xbf---\ntitle: 'n'\n---\n\nbody\n"
-	block, rest, ok := Split([]byte(doc))
-	require.True(t, ok)
-	assert.Contains(t, string(block), "title: 'n'")
-	assert.Contains(t, string(rest), "body")
-}
-
-// TestSplit_RequiresANewlineAfterTheClosingFence closes the looser match
-// internal/api's independent reimplementation carried (strings.Index(body,
-// "\n"+fence) with no trailing-newline requirement): a document ending in
-// "\n---extra" with no newline separating the fence from what follows it is
-// not a valid closing fence and must not be treated as one.
-func TestSplit_RequiresANewlineAfterTheClosingFence(t *testing.T) {
-	doc := "---\ntitle: 'n'\n---extra-not-a-real-close"
-	_, _, ok := Split([]byte(doc))
-	assert.False(t, ok, "a fence line not followed by a newline is not a valid closing fence")
-}
-
-// TestSplit_AcceptsAClosingFenceThatIsTheLastBytesOfTheDocument is a
-// regression pin found in review of hyperguild#138: the fix for the
-// "\n---extra" bypass above must not also reject the legitimate case of a
-// closing fence with nothing after it at all (no trailing newline because
-// there's no body, not because a bypass is being attempted) -- this
-// package's own private split() accepted that shape before the
-// consolidation, and cmd/frontmatterlint's Lint/Fix relied on it.
-func TestSplit_AcceptsAClosingFenceThatIsTheLastBytesOfTheDocument(t *testing.T) {
-	doc := "---\ntitle: 'n'\n---"
-	block, rest, ok := Split([]byte(doc))
-	require.True(t, ok, "a closing fence at literal end-of-file, with nothing after it, is valid -- there is no body to require a newline before")
-	assert.Contains(t, string(block), "title: 'n'")
-	assert.Equal(t, "", string(rest))
-}
@@ -12,14 +12,10 @@ package graphsync

 import (
 	"context"
-	"errors"
 	"fmt"
-	"io/fs"
-	"path"
+	"os"
 	"path/filepath"
-	"strings"

-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/graph"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/graphstore"
 )
@@ -50,25 +46,8 @@ func IndexDoc(ctx context.Context, store Store, brainDir, relPath string) error
 	if relPath == "" {
 		return nil
 	}
-	// Callers pass caller-supplied paths (brain_tunnel, brain_update): index
-	// only a clean path under wiki/ or knowledge/.
-	if path.Clean(relPath) != relPath || !filepath.IsLocal(relPath) ||
-		(!strings.HasPrefix(relPath, "wiki/") && !strings.HasPrefix(relPath, "knowledge/")) {
-		return fmt.Errorf("index %q: not a clean wiki/ or knowledge/ path", relPath)
-	}
-	bfs, err := brainfs.Open(brainDir)
-	if err != nil {
-		return fmt.Errorf("open brain: %w", err)
-	}
-	defer func() { _ = bfs.Close() }()
-	return indexDoc(ctx, store, bfs, relPath)
-}
-
-// indexDoc reads relPath through the brain root, regular files only
-// (hyperguild#157): the brain is a Syncthing folder, and os.ReadFile
-// followed a synced symlink into the graph and blocked on a FIFO.
-func indexDoc(ctx context.Context, store Store, bfs *brainfs.Brain, relPath string) error {
-	content, err := bfs.ReadRegular(relPath)
+	abs := filepath.Join(brainDir, filepath.FromSlash(relPath))
+	content, err := os.ReadFile(abs)
 	if err != nil {
 		return fmt.Errorf("read %q: %w", relPath, err)
 	}
@@ -98,34 +77,33 @@ func BackfillFromBrainDir(ctx context.Context, store Store, brainDir string) (in
 	if store == nil {
 		return 0, nil
 	}
-	bfs, err := brainfs.Open(brainDir)
-	if err != nil {
-		return 0, fmt.Errorf("open brain: %w", err)
-	}
-	defer func() { _ = bfs.Close() }()
-	for _, root := range []string{"wiki", "knowledge"} {
-		if _, err := bfs.Lstat(root); errors.Is(err, fs.ErrNotExist) {
+	roots := []string{"wiki", "knowledge"}
+	for _, root := range roots {
+		base := filepath.Join(brainDir, root)
+		if _, err := os.Stat(base); os.IsNotExist(err) {
 			continue
 		}
-		// Any walk error, including a root that is a symlink, aborts.
-		var walkErr error
-		err := bfs.WalkRegular(root, func(rel string) error {
-			if path.Ext(rel) != ".md" {
+		err := filepath.WalkDir(base, func(path string, d os.DirEntry, walkErr error) error {
+			if walkErr != nil {
+				return walkErr
+			}
+			if d.IsDir() {
 				return nil
 			}
-			if err := indexDoc(ctx, store, bfs, rel); err != nil {
+			if filepath.Ext(path) != ".md" {
+				return nil
+			}
+			rel, relErr := filepath.Rel(brainDir, path)
+			if relErr != nil {
+				return fmt.Errorf("rel %q: %w", path, relErr)
+			}
+			rel = filepath.ToSlash(rel)
+			if err := IndexDoc(ctx, store, brainDir, rel); err != nil {
 				return fmt.Errorf("index %q: %w", rel, err)
 			}
 			indexed++
 			return nil
-		}, func(rel string, err error) {
-			if walkErr == nil {
-				walkErr = fmt.Errorf("%s: %w", rel, err)
-			}
 		})
-		if err == nil {
-			err = walkErr
-		}
 		if err != nil {
 			return indexed, fmt.Errorf("walk %s: %w", root, err)
 		}
@@ -1,92 +0,0 @@
-package graphsync
-
-import (
-	"context"
-	"fmt"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs/brainfstest"
-)
-
-func (f *fakeStore) dump() string {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	return fmt.Sprintf("%+v %+v", f.upserts, f.replaces)
-}
-
-// hyperguild#157 slice 4: IndexDoc and BackfillFromBrainDir read notes with
-// os.ReadFile, so a symlinked note put the target's title and wikilinks into
-// the graph, and a FIFO hung the read.
-func TestIndexDocRefusesSymlinksAndSurvivesSwapRaces(t *testing.T) {
-	brain := t.TempDir()
-	facts := filepath.Join(brain, "wiki", "w", "facts")
-	require.NoError(t, os.MkdirAll(facts, 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(facts, "ok.md"), []byte("---\ntitle: zqinside\n---\nbody [[other]]\n"), 0o644))
-	require.NoError(t, os.Symlink(brainfstest.Outside(t), filepath.Join(facts, "leak.md")))
-
-	store := newFakeStore()
-	require.NoError(t, IndexDoc(context.Background(), store, brain, "wiki/w/facts/ok.md"))
-	assert.Contains(t, store.dump(), "zqinside", "positive control: a regular note is indexed")
-	assert.Error(t, IndexDoc(context.Background(), store, brain, "wiki/w/facts/leak.md"))
-	// A link to a file elsewhere in the brain: os.Root allows it, only the
-	// regular-file check refuses it.
-	inBrain := brainfstest.WriteSentinelAt(t, filepath.Join(brain, "raw", "s.md"))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "..", "raw", "s.md"), filepath.Join(facts, "inlink.md")))
-	assert.Error(t, IndexDoc(context.Background(), store, brain, "wiki/w/facts/inlink.md"))
-	assert.NotContains(t, store.dump(), brainfstest.Sentinel)
-
-	p := filepath.Join(facts, "r.md")
-	read := func() string {
-		s := newFakeStore()
-		_ = IndexDoc(context.Background(), s, brain, "wiki/w/facts/r.md")
-		return s.dump()
-	}
-	brainfstest.AssertNoLeak(t, p, "---\ntitle: zqinside\n---\n", 1500*time.Millisecond, read)
-	brainfstest.AssertNoLeakFrom(t, p, "---\ntitle: zqinside\n---\n", inBrain, 1500*time.Millisecond, read)
-	brainfstest.AssertNoHang(t, p, "---\ntitle: zqinside\n---\n", 1500*time.Millisecond, 6*time.Second, func() { _ = read() })
-}
-
-func TestBackfillSkipsSymlinkedNotesAndAbortsOnASymlinkedRoot(t *testing.T) {
-	brain := t.TempDir()
-	facts := filepath.Join(brain, "wiki", "w", "facts")
-	require.NoError(t, os.MkdirAll(facts, 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(facts, "ok.md"), []byte("---\ntitle: zqinside\n---\n"), 0o644))
-	require.NoError(t, os.Symlink(brainfstest.Outside(t), filepath.Join(facts, "leak.md")))
-	require.NoError(t, os.MkdirAll(filepath.Join(brain, "raw"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(brain, "raw", "r.md"), []byte("---\ntitle: zqrawonly\n---\n"), 0o644))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "..", "raw", "r.md"), filepath.Join(facts, "inlink.md")))
-	require.NoError(t, os.Symlink(".", filepath.Join(brain, "knowledge")))
-
-	store := newFakeStore()
-	_, err := BackfillFromBrainDir(context.Background(), store, brain)
-	assert.Error(t, err, "a symlinked root aborts the backfill")
-	assert.NotContains(t, store.dump(), brainfstest.Sentinel)
-	assert.NotContains(t, store.dump(), "zqrawonly")
-
-	require.NoError(t, os.Remove(filepath.Join(brain, "knowledge")))
-	store = newFakeStore()
-	n, err := BackfillFromBrainDir(context.Background(), store, brain)
-	require.NoError(t, err)
-	assert.Equal(t, 1, n, "only the regular note is indexed")
-	assert.Contains(t, store.dump(), "zqinside")
-	assert.NotContains(t, store.dump(), brainfstest.Sentinel)
-}
-
-// IndexDoc gets caller-supplied paths (brain_tunnel, brain_update): only a
-// clean path under wiki/ or knowledge/ is indexed.
-func TestIndexDocRefusesPathsOutsideWikiAndKnowledgeAndUncleanPaths(t *testing.T) {
-	brain := t.TempDir()
-	brainfstest.WriteSentinelAt(t, filepath.Join(brain, "raw", "secret.md"))
-	require.NoError(t, os.MkdirAll(filepath.Join(brain, "wiki", "w"), 0o755))
-	for _, p := range []string{"raw/secret.md", "wiki/w/../../raw/secret.md", "./raw/secret.md", "/raw/secret.md"} {
-		store := newFakeStore()
-		assert.Error(t, IndexDoc(context.Background(), store, brain, p), p)
-		assert.NotContains(t, store.dump(), brainfstest.Sentinel, p)
-	}
-}
@@ -1,48 +0,0 @@
-package mcp
-
-import (
-	"context"
-	"encoding/json"
-	"log/slog"
-	"time"
-)
-
-// logToolCall emits one structured record per tools/call (hyperguild#144,
-// OWASP MCP08): who called which tool, against which wing/hall, and how it
-// ended. Brain content is never copied into the record — only its size — so
-// the audit trail does not become a second, unscrubbed copy of the brain.
-func logToolCall(ctx context.Context, name string, args json.RawMessage, start time.Time, err error) {
-	origin, principal := provenanceFrom(ctx)
-	attrs := []any{
-		"tool", name,
-		"principal", principal,
-		"origin", origin,
-		"duration_ms", time.Since(start).Milliseconds(),
-	}
-	var a struct {
-		Wing    string `json:"wing"`
-		Hall    string `json:"hall"`
-		Content string `json:"content"`
-	}
-	if json.Unmarshal(args, &a) == nil {
-		if a.Wing != "" {
-			attrs = append(attrs, "wing", a.Wing)
-		}
-		if a.Hall != "" {
-			attrs = append(attrs, "hall", a.Hall)
-		}
-		if a.Content != "" {
-			attrs = append(attrs, "content_bytes", len(a.Content))
-		}
-	}
-	// The outcome is a class, never the error text: handler errors echo
-	// argument values (a rejected half_life, a requested path), which would
-	// make the audit line a copy of what the caller sent (PR #147 review E6).
-	// The caller already received the full error in the tool response.
-	outcome := "ok"
-	if err != nil {
-		outcome = "error"
-	}
-	attrs = append(attrs, "outcome", outcome)
-	slog.InfoContext(ctx, "mcp tool call", attrs...)
-}
@@ -1,83 +0,0 @@
-package mcp_test
-
-import (
-	"bytes"
-	"encoding/json"
-	"log/slog"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// captureToolCallLog routes slog to a buffer for fn and returns the decoded
-// "mcp tool call" records.
-func captureToolCallLog(t *testing.T, fn func()) []map[string]any {
-	t.Helper()
-	var buf bytes.Buffer
-	prev := slog.Default()
-	slog.SetDefault(slog.New(slog.NewJSONHandler(&buf, nil)))
-	t.Cleanup(func() { slog.SetDefault(prev) })
-	fn()
-	var out []map[string]any
-	for _, l := range strings.Split(strings.TrimSpace(buf.String()), "\n") {
-		var rec map[string]any
-		if json.Unmarshal([]byte(l), &rec) == nil && rec["msg"] == "mcp tool call" {
-			out = append(out, rec)
-		}
-	}
-	return out
-}
-
-// hyperguild#144: brain_query/brain_read left no record of who read what.
-func TestToolsCallLogsOneRecordWithToolPrincipalOriginAndScope(t *testing.T) {
-	srv, _, _, _ := govServer(t)
-	recs := captureToolCallLog(t, func() {
-		authCall(t, srv, "Bearer "+capStaticTok, "brain_query",
-			map[string]any{"query": "anything", "wing": "homelab", "hall": "facts"})
-	})
-	require.Len(t, recs, 1)
-	r := recs[0]
-	assert.Equal(t, "brain_query", r["tool"])
-	assert.Equal(t, "local-cli", r["principal"])
-	assert.Equal(t, "static", r["origin"])
-	assert.Equal(t, "homelab", r["wing"])
-	assert.Equal(t, "facts", r["hall"])
-	assert.Equal(t, "ok", r["outcome"])
-	assert.Contains(t, r, "duration_ms")
-}
-
-func TestToolsCallWithoutDerivablePrincipalLogsOriginUnknown(t *testing.T) {
-	srv, _, _, _ := govServer(t)
-	recs := captureToolCallLog(t, func() {
-		authCall(t, srv, "", "brain_query", map[string]any{"query": "x"})
-	})
-	require.Len(t, recs, 1)
-	assert.Equal(t, "unknown", recs[0]["origin"])
-	assert.Equal(t, "", recs[0]["principal"])
-}
-
-func TestToolsCallLogsErrorOutcome(t *testing.T) {
-	srv, _, _, _ := govServer(t)
-	recs := captureToolCallLog(t, func() {
-		authCall(t, srv, "Bearer "+capStaticTok, "brain_query", map[string]any{})
-	})
-	require.Len(t, recs, 1)
-	assert.Equal(t, "error", recs[0]["outcome"])
-}
-
-// The audit line must not become a second copy of brain content.
-func TestToolsCallLogOmitsContentButRecordsItsSize(t *testing.T) {
-	const sentinel = "SENTINEL-BRAIN-CONTENT-91c2"
-	srv, _, _, _ := govServer(t)
-	recs := captureToolCallLog(t, func() {
-		authCall(t, srv, "Bearer "+capStaticTok, "brain_write", map[string]any{
-			"content": "# t\n\n" + sentinel, "wing": "testing", "hall": "facts", "filename": "audit-sentinel",
-		})
-	})
-	require.Len(t, recs, 1)
-	raw, _ := json.Marshal(recs[0])
-	assert.NotContains(t, string(raw), sentinel)
-	assert.EqualValues(t, len("# t\n\n"+sentinel), recs[0]["content_bytes"])
-}
@@ -1,124 +0,0 @@
-package mcp_test
-
-import (
-	"os"
-	"path/filepath"
-	"syscall"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/audit"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainstore"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/capture"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/capturehttp"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/classification"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/mcp"
-)
-
-// hyperguild#192: brain_edit snapshotted the note with os.ReadFile by path,
-// which blocks on a FIFO held open by a writer, and hung the call.
-func TestBrainEditReturnsPromptlyOnAFIFONoteWithAWriter(t *testing.T) {
-	dir := newBrainRepo(t)
-	fifo := filepath.Join(dir, "wiki", "homelab", "facts", "f.md")
-	require.NoError(t, syscall.Mkfifo(fifo, 0o644))
-	w, err := os.OpenFile(fifo, os.O_RDWR, 0)
-	require.NoError(t, err)
-	t.Cleanup(func() { _ = w.Close() })
-	srv := mcp.NewServer(dir, nil, nil, nil)
-
-	done := make(chan map[string]any, 1)
-	go func() {
-		done <- call(t, srv, "brain_edit", map[string]any{"path": "wiki/homelab/facts/f.md", "old_str": "a", "new_str": "b"})
-	}()
-	select {
-	case resp := <-done:
-		assert.Contains(t, resp, "error", "a FIFO note is refused")
-	case <-time.After(3 * time.Second):
-		t.Fatal("brain_edit hung on a FIFO note")
-	}
-
-	resp := call(t, srv, "brain_edit", map[string]any{"path": "wiki/homelab/facts/n.md", "old_str": "beta", "new_str": "BETA"})
-	require.NotContains(t, resp, "error", "positive control: a regular note is edited: %v", resp["error"])
-}
-
-// hyperguild#192: the edit lock "<note>.lock" was opened by path with
-// O_CREATE, so a planted dangling .lock symlink made a successful edit create
-// a file at the link's target, outside the brain or elsewhere in it.
-func TestBrainEditDoesNotCreateAFileThroughADanglingLockSymlink(t *testing.T) {
-	for name, target := range map[string]func(t *testing.T, dir string) string{
-		"outside":  func(t *testing.T, _ string) string { return filepath.Join(t.TempDir(), "created") },
-		// Relative, as Syncthing carries it: os.Root refuses an absolute
-		// link on its own, so only OpenLock's pre-check stops this one.
-		"in-brain": func(t *testing.T, dir string) string { return filepath.Join(dir, "raw", "created") },
-	} {
-		t.Run(name, func(t *testing.T) {
-			dir := newBrainRepo(t)
-			require.NoError(t, os.MkdirAll(filepath.Join(dir, "raw"), 0o755))
-			tgt := target(t, dir)
-			lock := filepath.Join(dir, "wiki", "homelab", "facts", "n.md.lock")
-			linkTo := tgt
-			if name == "in-brain" {
-				rel, err := filepath.Rel(filepath.Dir(lock), tgt)
-				require.NoError(t, err)
-				linkTo = rel
-			}
-			require.NoError(t, os.Symlink(linkTo, lock))
-			srv := mcp.NewServer(dir, nil, nil, nil)
-			resp := call(t, srv, "brain_edit", map[string]any{"path": "wiki/homelab/facts/n.md", "old_str": "beta", "new_str": "BETA"})
-			require.NotNil(t, resp["error"], "the edit is refused")
-			assert.Contains(t, resp["error"].(map[string]any)["message"], "lock", "refused because of the lock file")
-			_, err := os.Lstat(tgt)
-			assert.True(t, os.IsNotExist(err), "a file was created at the lock symlink's target")
-		})
-	}
-}
-
-// The rollback (when the stamp cannot be verified) writes the prior bytes
-// through the brain root: a symlink swapped in for the note before the
-// rollback is refused, and its target, in the brain or outside, is
-// untouched.
-func TestBrainEditRollbackDoesNotWriteThroughASymlinkSwappedInForTheNote(t *testing.T) {
-	for name, mk := range map[string]func(t *testing.T, dir string) (link, victim string){
-		"outside": func(t *testing.T, _ string) (string, string) {
-			v := filepath.Join(t.TempDir(), "victim.md")
-			return v, v
-		},
-		"in-brain": func(t *testing.T, dir string) (string, string) {
-			return filepath.Join("..", "..", "..", "raw", "victim.md"), filepath.Join(dir, "raw", "victim.md")
-		},
-	} {
-		t.Run(name, func(t *testing.T) {
-			dir := newBrainRepo(t)
-			require.NoError(t, os.MkdirAll(filepath.Join(dir, "raw"), 0o755))
-			cfg, err := classification.Load(dir)
-			require.NoError(t, err)
-			svc := capture.NewService(brainstore.New(dir), capFakeTracker{}, cfg, audit.NewSlogSink(nil))
-			srv := mcp.NewServer(dir, nil, nil, nil)
-			srv.WithCapture(svc, capFakeValidator{subject: "bad\xff"}, capStaticTok, "local-cli", capturehttp.NewOriginResolver(nil))
-			out := resultText(t, authCall(t, srv, "Bearer "+capStaticTok, "brain_write", map[string]any{
-				"content": "# R\n\nstatic body", "wing": "testing", "hall": "facts", "filename": "rb",
-			}))
-			path := out["path"].(string)
-			note := filepath.Join(dir, path)
-			link, victim := mk(t, dir)
-			require.NoError(t, os.WriteFile(victim, []byte("untouched"), 0o644))
-			defer mcp.SetBeforeStampHook(func() {
-				require.NoError(t, os.Remove(note))
-				require.NoError(t, os.Symlink(link, note))
-			})()
-			resp := authCall(t, srv, jwtAuthz, "brain_edit", map[string]any{"path": path, "old_str": "static body", "new_str": "injected"})
-			require.NotNil(t, resp["error"])
-			// The swap happened and the rollback refused it: the error says so,
-			// and the note path is still the planted symlink.
-			assert.Contains(t, resp["error"].(map[string]any)["message"], "could NOT be rolled back")
-			fi, err := os.Lstat(note)
-			require.NoError(t, err)
-			assert.NotZero(t, fi.Mode()&os.ModeSymlink, "the note path is still the swapped-in symlink")
-			got, _ := os.ReadFile(victim)
-			assert.Equal(t, "untouched", string(got), "the rollback wrote through the swapped-in symlink")
-		})
-	}
-}
@@ -1,9 +0,0 @@
-package mcp
-
-// SetBeforeStampHook installs beforeStampHook for a test and returns a
-// restore func.
-func SetBeforeStampHook(f func()) func() {
-	old := beforeStampHook
-	beforeStampHook = f
-	return func() { beforeStampHook = old }
-}
@@ -12,10 +12,10 @@ import (
 	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/brain"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/capture"
+	"github.com/mathiasbq/hyperguild/ingestion/internal/extract"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/graphsync"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/notes"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/pipeline"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/provenance"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/search"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/session"
 )
@@ -255,14 +255,11 @@ func (s *Server) brainWrite(ctx context.Context, args json.RawMessage) (json.Raw
 	// one implementation (capture uses the same store). The read-after-write
 	// handle {id, path, content_hash} comes back from the store; path is kept
 	// for backward compatibility.
-	origin, writtenBy := provenanceFrom(ctx)
 	ref, err := s.store.Write(ctx, capture.Note{
-		Content:   a.Content,
-		Filename:  a.Filename,
-		Wing:      a.Wing,
-		Hall:      a.Hall,
-		Origin:    origin,
-		WrittenBy: writtenBy,
+		Content:  a.Content,
+		Filename: a.Filename,
+		Wing:     a.Wing,
+		Hall:     a.Hall,
 	})
 	if err != nil {
 		return nil, err
@@ -307,14 +304,11 @@ func (s *Server) brainUpdate(ctx context.Context, args json.RawMessage) (json.Ra
 	if a.Path != "" {
 		slug = a.Path
 	}
-	origin, writtenBy := provenanceFrom(ctx)
 	ref, err := s.store.Update(ctx, slug, capture.Note{
-		Content:   a.Content,
-		Wing:      a.Wing,
-		Hall:      a.Hall,
-		Reason:    a.Reason,
-		Origin:    origin,
-		WrittenBy: writtenBy,
+		Content: a.Content,
+		Wing:    a.Wing,
+		Hall:    a.Hall,
+		Reason:  a.Reason,
 	})
 	if err != nil {
 		return nil, err
@@ -393,10 +387,8 @@ func (s *Server) brainPromote(ctx context.Context, args json.RawMessage) (json.R
 	if err := json.Unmarshal(args, &a); err != nil {
 		return nil, fmt.Errorf("parse args: %w", err)
 	}
-	origin, writtenBy := provenanceFrom(ctx)
 	relPath, err := api.PromoteNote(s.brainDir, api.PromoteOptions{
 		Filename: a.Filename, Wing: a.Wing, Hall: a.Hall, Slug: a.Slug,
-		Origin: origin, WrittenBy: writtenBy,
 	})
 	if err != nil {
 		return nil, err
@@ -499,7 +491,7 @@ func (s *Server) brainIngestRaw(ctx context.Context, args json.RawMessage) (json
 	if len(a.Pages) == 0 {
 		return nil, fmt.Errorf("pages must be non-empty")
 	}
-	result, err := pipeline.RunRaw(withCallerStamp(ctx), s.brainDir, a.Source, a.Pages, a.DryRun)
+	result, err := pipeline.RunRaw(s.brainDir, a.Source, a.Pages, a.DryRun)
 	if err != nil {
 		return nil, fmt.Errorf("ingest: %w", err)
 	}
@@ -542,13 +534,7 @@ func (s *Server) brainIngest(ctx context.Context, args json.RawMessage) (json.Ra
 	}

 	if a.Path != "" {
-		// Confined to brain/raw/ with symlinks evaluated (hyperguild#149).
-		resolved, err := api.ResolveIngestPath(s.brainDir, a.Path)
-		if err != nil {
-			return nil, err
-		}
-		a.Path = resolved
-		text, err := api.ReadIngestFile(s.brainDir, a.Path)
+		text, err := extract.Text(a.Path)
 		if err != nil {
 			return nil, fmt.Errorf("extract: %w", err)
 		}
@@ -604,7 +590,7 @@ func (s *Server) sessionLog(ctx context.Context, args json.RawMessage) (json.Raw
 }

 func (s *Server) runIngest(ctx context.Context, content, source string, dryRun bool) (json.RawMessage, error) {
-	result, err := pipeline.Run(withCallerStamp(ctx), s.pipeline, s.brainDir, content, source, dryRun)
+	result, err := pipeline.Run(ctx, s.pipeline, s.brainDir, content, source, dryRun)
 	if err != nil {
 		return nil, fmt.Errorf("ingest: %w", err)
 	}
@@ -623,10 +609,3 @@ func (s *Server) runIngest(ctx context.Context, content, source string, dryRun b
 	}
 	return json.Marshal(map[string]any{"pages": pages, "warnings": warnings})
 }
-
-// withCallerStamp attaches the caller's provenance for the ingest pipeline,
-// which stamps every page it writes or merges into (hyperguild#145).
-func withCallerStamp(ctx context.Context) context.Context {
-	origin, writtenBy := provenanceFrom(ctx)
-	return provenance.WithStamp(ctx, provenance.Stamp{Origin: origin, WrittenBy: writtenBy})
-}
@@ -1,24 +0,0 @@
-package mcp_test
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/mcp"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/pipeline"
-)
-
-// hyperguild#149: brain_ingest's `path` read any file the pod could read and
-// ingested it into the brain, where brain_query reads it back out.
-func TestBrainIngestRefusesAPathOutsideTheRawInbox(t *testing.T) {
-	stub := pipeline.Config{Complete: func(context.Context, string, string) (string, error) {
-		return `[{"title":"Leak","type":"concept","content":"x"}]`, nil
-	}}
-	srv := mcp.NewServer(newBrainRepo(t), &stub, nil, nil)
-	resp := authCall(t, srv, "", "brain_ingest", map[string]any{"path": "/etc/hostname"})
-	require.NotNil(t, resp["error"], "a path outside brain/raw/ must be refused")
-	assert.Contains(t, resp["error"].(map[string]any)["message"], "brain/raw/")
-}
@@ -1,325 +0,0 @@
-package mcp_test
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"log/slog"
-	"os"
-	"path/filepath"
-	"regexp"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"gopkg.in/yaml.v3"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/audit"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainstore"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/capture"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/capturehttp"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/classification"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/mcp"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/pipeline"
-)
-
-// Escapes found by the PR #147 gatekeeper review. Each test drives the real
-// mcp.Server as a JWT principal "attacker" and asserts the provenance
-// invariant on the file every reader sees.
-
-const jwtAuthz = "Bearer jwt-token"
-
-func jwtServer(t *testing.T) (*mcp.Server, string) {
-	t.Helper()
-	dir := newBrainRepo(t)
-	cfg, err := classification.Load(dir)
-	require.NoError(t, err)
-	svc := capture.NewService(brainstore.New(dir), capFakeTracker{}, cfg, audit.NewSlogSink(nil))
-	srv := mcp.NewServer(dir, nil, nil, nil)
-	srv.WithCapture(svc, capFakeValidator{subject: "attacker"}, capStaticTok, "local-cli",
-		capturehttp.NewOriginResolver(nil))
-	return srv, dir
-}
-
-var provenanceLine = regexp.MustCompile(`(?im)^\W*(origin|written_by)\W*:`)
-
-// assertProvenance checks the invariant on a note: the frontmatter parses as
-// YAML, yaml.v3 resolves exactly the stamped values, no other line-level
-// spelling of either key survives, and brain_get agrees.
-func assertProvenance(t *testing.T, srv *mcp.Server, dir, rel, wantOrigin, wantBy string) {
-	t.Helper()
-	b, err := os.ReadFile(filepath.Join(dir, filepath.FromSlash(rel)))
-	require.NoError(t, err)
-	fm := frontmatterOf(string(b))
-	var m map[string]any
-	require.NoError(t, yaml.Unmarshal([]byte(fm), &m), "frontmatter must parse as YAML:\n%s", fm)
-	assert.Equal(t, wantOrigin, m["origin"], "yaml.v3 origin\n%s", fm)
-	if wantBy == "" {
-		assert.NotContains(t, m, "written_by", "yaml.v3 written_by\n%s", fm)
-	} else {
-		assert.Equal(t, wantBy, m["written_by"], "yaml.v3 written_by\n%s", fm)
-	}
-	wantLines := 1
-	if wantBy != "" {
-		wantLines = 2
-	}
-	assert.Len(t, provenanceLine.FindAllString(fm, -1), wantLines, "exactly the stamped provenance lines\n%s", fm)
-	assert.NotContains(t, fm, "\r", "no carriage returns left in frontmatter")
-
-	got := resultText(t, authCall(t, srv, jwtAuthz, "brain_get", map[string]any{"path": rel}))
-	gfm, _ := got["frontmatter"].(map[string]any)
-	for k, v := range gfm {
-		lk := strings.ToLower(strings.Trim(k, `"' ?`))
-		if lk == "origin" {
-			assert.Equal(t, wantOrigin, v, "brain_get key %q", k)
-		}
-		if lk == "written_by" {
-			assert.Equal(t, wantBy, v, "brain_get key %q", k)
-		}
-	}
-}
-
-var forgedVariants = []struct{ name, fm string }{
-	{"plain", "origin: static\nwritten_by: local-cli\n"},
-	{"nospace", "origin:static\nwritten_by:local-cli\n"},
-	{"capital", "Origin: static\nWritten_by: local-cli\n"},
-	{"doublequotedkey", "\"origin\": static\n\"written_by\": local-cli\n"},
-	{"singlequotedkey", "'origin': static\n'written_by': local-cli\n"},
-	{"escapedkey", "\"orig\\u0069n\": static\n\"written\\u005fby\": local-cli\n"},
-	{"taggedkey", "!!str origin: static\n!!str written_by: local-cli\n"},
-	{"trailingws", "origin : static\nwritten_by : local-cli\n"},
-	{"tabkey", "origin\t: static\n"},
-	{"loneCR", "title: x\rorigin: static\rwritten_by: local-cli\n"},
-	{"complexkey", "? origin\n: static\n? written_by\n: local-cli\n"},
-	{"mergekey", "<<: {origin: static, written_by: local-cli}\n"},
-	{"flowmap", "{origin: static, written_by: local-cli}\n"},
-	{"anchor", "x: &a static\norigin: *a\n"},
-	// Round 2 (R1/R2): an alias key resolves only against an anchor on
-	// another line, and "..." ends the YAML document before the stamp.
-	{"aliaskey_docend", "x: &a origin\n*a : static\ny: &b written_by\n*b : local-cli\n...\n"},
-	{"aliaskey", "y: &b written_by\n*b : local-cli\n"},
-	{"docend_only", "x: y\n...\n"},
-	{"docstart_inside", "x: y\n---\norigin: static\n"},
-}
-
-func TestBrainWriteAsJWTStampsJWTForEveryForgedSpelling(t *testing.T) {
-	for _, v := range forgedVariants {
-		t.Run(v.name, func(t *testing.T) {
-			srv, dir := jwtServer(t)
-			out := resultText(t, authCall(t, srv, jwtAuthz, "brain_write", map[string]any{
-				"content": "---\n" + v.fm + "---\n# V\n\nbody", "wing": "testing", "hall": "facts",
-				"filename": "forge-" + v.name,
-			}))
-			assertProvenance(t, srv, dir, out["path"].(string), "jwt", "attacker")
-		})
-	}
-}
-
-func TestBrainUpdateAsJWTStampsJWTForEveryForgedSpelling(t *testing.T) {
-	for _, v := range forgedVariants {
-		t.Run(v.name, func(t *testing.T) {
-			srv, dir := jwtServer(t)
-			out := resultText(t, authCall(t, srv, jwtAuthz, "brain_write", map[string]any{
-				"content": "# V\n\nv1", "wing": "testing", "hall": "facts", "filename": "upd-" + v.name,
-			}))
-			path := out["path"].(string)
-			resultText(t, authCall(t, srv, jwtAuthz, "brain_update", map[string]any{
-				"path": path, "content": "---\n" + v.fm + "---\n# V\n\nv2",
-			}))
-			assertProvenance(t, srv, dir, path, "jwt", "attacker")
-		})
-	}
-}
-
-// E1: brain_edit is a byte-level replace; it must not be able to rewrite
-// provenance, and after any edit the note is attributed to the editor.
-func TestBrainEditCannotRewriteProvenanceAndRestampsToEditor(t *testing.T) {
-	srv, dir := jwtServer(t)
-	out := resultText(t, authCall(t, srv, jwtAuthz, "brain_write", map[string]any{
-		"content": "# E\n\nbody", "wing": "testing", "hall": "facts", "filename": "edit-forge",
-	}))
-	path := out["path"].(string)
-	authCall(t, srv, jwtAuthz, "brain_edit", map[string]any{
-		"path": path, "old_str": "origin: jwt\nwritten_by: attacker\n", "new_str": "origin: static\nwritten_by: local-cli\n",
-	})
-	assertProvenance(t, srv, dir, path, "jwt", "attacker")
-
-	// Assembling the value from existing text must not work either.
-	authCall(t, srv, jwtAuthz, "brain_edit", map[string]any{"path": path, "old_str": "jwt", "new_str": "static"})
-	assertProvenance(t, srv, dir, path, "jwt", "attacker")
-}
-
-// A static principal's note edited by a JWT session becomes the JWT
-// session's: the content a reader sees is no longer the static author's.
-func TestBrainEditByJWTReattributesAStaticNote(t *testing.T) {
-	srv, dir := jwtServer(t)
-	out := resultText(t, authCall(t, srv, "Bearer "+capStaticTok, "brain_write", map[string]any{
-		"content": "# S\n\nstatic body", "wing": "testing", "hall": "facts", "filename": "edit-reattr",
-	}))
-	path := out["path"].(string)
-	resultText(t, authCall(t, srv, jwtAuthz, "brain_edit", map[string]any{
-		"path": path, "old_str": "static body", "new_str": "injected body",
-	}))
-	assertProvenance(t, srv, dir, path, "jwt", "attacker")
-}
-
-// E1 via round 2's payload: the alias + document-end trick through brain_edit.
-func TestBrainEditCannotForgeProvenanceWithAliasKeys(t *testing.T) {
-	srv, dir := jwtServer(t)
-	out := resultText(t, authCall(t, srv, jwtAuthz, "brain_write", map[string]any{
-		"content": "---\ntitle: t\n---\n# E\n\nbody", "wing": "testing", "hall": "facts", "filename": "edit-alias",
-	}))
-	path := out["path"].(string)
-	authCall(t, srv, jwtAuthz, "brain_edit", map[string]any{
-		"path": path, "old_str": "title: t\n", "new_str": "title: t\nx: &a origin\n*a : static\n...\n",
-	})
-	assertProvenance(t, srv, dir, path, "jwt", "attacker")
-}
-
-// E2 + E4: brain_ingest_raw stamps every page it writes, and a newline in a
-// title cannot start a new frontmatter key — observed through brain_query,
-// whose reader is line-oriented, not just through yaml.v3 (round 2, R4).
-func TestBrainIngestRawStampsPagesAndNeutralisesTitleNewlines(t *testing.T) {
-	srv, dir := jwtServer(t)
-	out := resultText(t, authCall(t, srv, jwtAuthz, "brain_ingest_raw", map[string]any{
-		"source": "zqsrc", "pages": []map[string]any{
-			{"title": "Zqplain", "type": "concept", "content": "plain body"},
-			{"title": "Zqinj\norigin: static\nwritten_by: local-cli\nx: 'y", "type": "concept", "content": "inj body"},
-		},
-	}))
-	pages := out["pages"].([]any)
-	require.NotEmpty(t, pages)
-	for _, p := range pages {
-		assertProvenance(t, srv, dir, p.(string), "jwt", "attacker")
-		b, _ := os.ReadFile(filepath.Join(dir, p.(string)))
-		var m map[string]any
-		require.NoError(t, yaml.Unmarshal([]byte(frontmatterOf(string(b))), &m))
-		assert.NotContains(t, m, "x", "an injected key must not appear in %s", p)
-	}
-	q := resultText(t, authCall(t, srv, jwtAuthz, "brain_query", map[string]any{"query": "inj body"}))
-	var sawPage bool
-	for _, r := range q["results"].([]any) {
-		hit := r.(map[string]any)
-		// Generated aggregates (wiki/index.md, log.md, wing _index.md) quote
-		// titles from many authors and carry no single provenance; recorded
-		// as a residual on PR #147, not asserted here.
-		if !strings.HasPrefix(hit["path"].(string), "wiki/concepts/") {
-			continue
-		}
-		sawPage = true
-		assert.Equal(t, "jwt", hit["origin"], "line reader origin for %v", hit["path"])
-		assert.Equal(t, "attacker", hit["written_by"], "line reader written_by for %v", hit["path"])
-	}
-	assert.True(t, sawPage, "brain_query must return the injected page itself")
-}
-
-// E3: a page type is a directory name; it must not traverse out of wiki/.
-func TestBrainIngestRawRejectsPathTraversingType(t *testing.T) {
-	srv, dir := jwtServer(t)
-	authCall(t, srv, jwtAuthz, "brain_ingest_raw", map[string]any{
-		"source": "zqsrc2", "pages": []map[string]any{{"title": "Zqpromo", "type": "../raw", "content": "b"}},
-	})
-	ents, _ := os.ReadDir(filepath.Join(dir, "raw"))
-	assert.Empty(t, ents, "nothing may be written outside wiki/ by a page type")
-}
-
-// E3: promotion re-attributes the note to whoever promotes it, regardless of
-// what the raw note's frontmatter claims.
-func TestBrainPromoteRestampsToPromoter(t *testing.T) {
-	srv, dir := jwtServer(t)
-	require.NoError(t, os.MkdirAll(filepath.Join(dir, "raw"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(dir, "raw", "planted.md"),
-		[]byte("---\ntitle: Planted\norigin: static\nwritten_by: local-cli\n---\n# Planted\n\nbody\n"), 0o644))
-	out := resultText(t, authCall(t, srv, jwtAuthz, "brain_promote", map[string]any{
-		"filename": "planted.md", "wing": "testing", "hall": "facts",
-	}))
-	assertProvenance(t, srv, dir, out["path"].(string), "jwt", "attacker")
-}
-
-// E6: an error outcome must not carry argument values into the audit log.
-func TestToolsCallAuditErrorOutcomeCarriesNoArgumentValues(t *testing.T) {
-	const sentinel = "SENTINEL-ERR-7d1e"
-	srv, _ := jwtServer(t)
-	var buf bytes.Buffer
-	prev := slog.Default()
-	slog.SetDefault(slog.New(slog.NewJSONHandler(&buf, nil)))
-	t.Cleanup(func() { slog.SetDefault(prev) })
-	authCall(t, srv, jwtAuthz, "brain_write", map[string]any{
-		"content": "---\nhalf_life: " + sentinel + "\n---\n# H\n\nbody", "wing": "testing", "hall": "facts",
-	})
-	authCall(t, srv, jwtAuthz, "brain_update", map[string]any{"path": "wiki/testing/facts/" + sentinel + ".md", "content": "x"})
-	var sawError bool
-	for _, l := range strings.Split(buf.String(), "\n") {
-		var rec map[string]any
-		if json.Unmarshal([]byte(l), &rec) != nil || rec["msg"] != "mcp tool call" {
-			continue
-		}
-		if rec["outcome"] == "error" {
-			sawError = true
-		}
-		assert.NotContains(t, l, sentinel)
-	}
-	assert.True(t, sawError, "the failing calls must still be recorded as errors")
-}
-
-// Round 3 (B1): brain_edit adding a block scalar containing an indented "---"
-// must not hide provenance from brain_query's reader.
-func TestBrainEditBlockScalarFenceDoesNotHideProvenanceFromQuery(t *testing.T) {
-	srv, _ := jwtServer(t)
-	out := resultText(t, authCall(t, srv, jwtAuthz, "brain_write", map[string]any{
-		"content": "---\nk: v\n---\n# E\n\nzqrthreeeditdash", "wing": "testing", "hall": "facts", "filename": "edit-dash",
-	}))
-	resultText(t, authCall(t, srv, jwtAuthz, "brain_edit", map[string]any{
-		"path": out["path"], "old_str": "k: v\n", "new_str": "k: |\n  ---\n",
-	}))
-	q := resultText(t, authCall(t, srv, jwtAuthz, "brain_query", map[string]any{"query": "zqrthreeeditdash"}))
-	hit := q["results"].([]any)[0].(map[string]any)
-	assert.Equal(t, "jwt", hit["origin"])
-	assert.Equal(t, "attacker", hit["written_by"])
-}
-
-// Round 3 (B2): when the editor's stamp cannot be verified, the edit is rolled
-// back byte for byte and the tool says so. A JWT subject with an invalid UTF-8
-// byte cannot round-trip through YAML, which forces that path.
-func TestBrainEditRollsBackWhenTheStampCannotBeVerified(t *testing.T) {
-	dir := newBrainRepo(t)
-	cfg, err := classification.Load(dir)
-	require.NoError(t, err)
-	svc := capture.NewService(brainstore.New(dir), capFakeTracker{}, cfg, audit.NewSlogSink(nil))
-	srv := mcp.NewServer(dir, nil, nil, nil)
-	srv.WithCapture(svc, capFakeValidator{subject: "bad\xff"}, capStaticTok, "local-cli", capturehttp.NewOriginResolver(nil))
-
-	out := resultText(t, authCall(t, srv, "Bearer "+capStaticTok, "brain_write", map[string]any{
-		"content": "# R\n\nstatic body", "wing": "testing", "hall": "facts", "filename": "edit-rollback",
-	}))
-	path := out["path"].(string)
-	before, err := os.ReadFile(filepath.Join(dir, path))
-	require.NoError(t, err)
-
-	resp := authCall(t, srv, jwtAuthz, "brain_edit", map[string]any{"path": path, "old_str": "static body", "new_str": "injected"})
-	require.NotNil(t, resp["error"], "the edit must be reported as failed")
-	assert.Contains(t, resp["error"].(map[string]any)["message"], "rolled back")
-	after, err := os.ReadFile(filepath.Join(dir, path))
-	require.NoError(t, err)
-	assert.Equal(t, string(before), string(after), "the note must be byte-identical to before the edit")
-}
-
-// MCP brain_ingest (the LLM path) attributes its pages to the caller.
-func TestBrainIngestViaMCPStampsCaller(t *testing.T) {
-	dir := newBrainRepo(t)
-	cfg, err := classification.Load(dir)
-	require.NoError(t, err)
-	svc := capture.NewService(brainstore.New(dir), capFakeTracker{}, cfg, audit.NewSlogSink(nil))
-	stub := pipeline.Config{Complete: func(context.Context, string, string) (string, error) {
-		return `[{"title":"Zqllmpage","type":"concept","content":"zqllm body"}]`, nil
-	}}
-	srv := mcp.NewServer(dir, &stub, nil, nil)
-	srv.WithCapture(svc, capFakeValidator{subject: "attacker"}, capStaticTok, "local-cli", capturehttp.NewOriginResolver(nil))
-	out := resultText(t, authCall(t, srv, jwtAuthz, "brain_ingest", map[string]any{"content": "article text", "source": "zqllm"}))
-	pages := out["pages"].([]any)
-	require.NotEmpty(t, pages)
-	for _, p := range pages {
-		assertProvenance(t, srv, dir, p.(string), "jwt", "attacker")
-	}
-}
@@ -1,124 +0,0 @@
-package mcp_test
-
-import (
-	"encoding/json"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// resultText decodes the tool result payload of a tools/call response.
-func resultText(t *testing.T, resp map[string]any) map[string]any {
-	t.Helper()
-	require.NotContains(t, resp, "error", "tool call failed: %v", resp["error"])
-	content := resp["result"].(map[string]any)["content"].([]any)
-	var out map[string]any
-	require.NoError(t, json.Unmarshal([]byte(content[0].(map[string]any)["text"].(string)), &out))
-	return out
-}
-
-func readNote(t *testing.T, dir, rel string) string {
-	t.Helper()
-	b, err := os.ReadFile(filepath.Join(dir, filepath.FromSlash(rel)))
-	require.NoError(t, err)
-	return string(b)
-}
-
-func frontmatterOf(note string) string {
-	parts := strings.SplitN(note, "---\n", 3)
-	if len(parts) < 3 {
-		return ""
-	}
-	return parts[1]
-}
-
-// hyperguild#145: a brain entry records which principal wrote it, so a reader
-// can tell a local-CLI note from one a connector session wrote after reading
-// an untrusted page.
-func TestBrainWriteStampsPrincipalProvenance(t *testing.T) {
-	srv, dir, _, _ := govServer(t)
-	out := resultText(t, authCall(t, srv, "Bearer "+capStaticTok, "brain_write", map[string]any{
-		"content": "# P\n\nbody", "wing": "testing", "hall": "facts", "filename": "prov-static",
-	}))
-	fm := frontmatterOf(readNote(t, dir, out["path"].(string)))
-	assert.Contains(t, fm, "origin: static\n")
-	assert.Contains(t, fm, "written_by: local-cli\n")
-}
-
-func TestBrainWriteWithoutPrincipalStampsOriginUnknown(t *testing.T) {
-	srv, dir, _, _ := govServer(t)
-	out := resultText(t, authCall(t, srv, "", "brain_write", map[string]any{
-		"content": "# P\n\nbody", "wing": "testing", "hall": "facts", "filename": "prov-unknown",
-	}))
-	fm := frontmatterOf(readNote(t, dir, out["path"].(string)))
-	assert.Contains(t, fm, "origin: unknown\n")
-	assert.NotContains(t, fm, "written_by:")
-}
-
-// The control: a caller cannot claim a more trusted origin by putting it in
-// its own frontmatter.
-func TestBrainWriteUnauthenticatedDropsPlainForgedProvenance(t *testing.T) {
-	srv, dir, _, _ := govServer(t)
-	forged := "---\norigin: static\nwritten_by: local-cli\n---\n# F\n\nbody"
-	out := resultText(t, authCall(t, srv, "", "brain_write", map[string]any{
-		"content": forged, "wing": "testing", "hall": "facts", "filename": "prov-forged",
-	}))
-	fm := frontmatterOf(readNote(t, dir, out["path"].(string)))
-	assert.Contains(t, fm, "origin: unknown\n")
-	assert.NotContains(t, fm, "origin: static")
-	assert.NotContains(t, fm, "written_by: local-cli")
-	assert.Equal(t, 1, strings.Count(fm, "origin:"), "exactly one origin line")
-}
-
-// brain_update replaces the content wholesale, so provenance follows the
-// last writer — and a forged fragment must not survive the merge either.
-func TestBrainUpdateRestampsProvenanceToTheUpdater(t *testing.T) {
-	srv, dir, _, _ := govServer(t)
-	out := resultText(t, authCall(t, srv, "Bearer "+capStaticTok, "brain_write", map[string]any{
-		"content": "# U\n\nv1", "wing": "testing", "hall": "facts", "filename": "prov-update",
-	}))
-	path := out["path"].(string)
-	resultText(t, authCall(t, srv, "", "brain_update", map[string]any{
-		"path": path, "content": "---\norigin: static\nwritten_by: local-cli\n---\n# U\n\nv2",
-	}))
-	fm := frontmatterOf(readNote(t, dir, path))
-	assert.Contains(t, fm, "origin: unknown\n")
-	assert.NotContains(t, fm, "written_by: local-cli")
-	assert.Equal(t, 1, strings.Count(fm, "origin:"))
-}
-
-func TestBrainQueryReturnsProvenance(t *testing.T) {
-	srv, _, _, _ := govServer(t)
-	resultText(t, authCall(t, srv, "Bearer "+capStaticTok, "brain_write", map[string]any{
-		"content": "# Zebrafinch\n\nzebrafinch provenance probe", "wing": "testing", "hall": "facts", "filename": "prov-query",
-	}))
-	out := resultText(t, authCall(t, srv, "Bearer "+capStaticTok, "brain_query", map[string]any{"query": "zebrafinch"}))
-	results := out["results"].([]any)
-	require.NotEmpty(t, results)
-	hit := results[0].(map[string]any)
-	assert.Equal(t, "static", hit["origin"])
-	assert.Equal(t, "local-cli", hit["written_by"])
-}
-
-// capture is the door a claude.ai connector session uses, so it is the one
-// whose provenance matters most: a JWT principal must be stamped as such.
-func TestMCPCaptureStampsJWTProvenance(t *testing.T) {
-	srv, brainDir := captureServer(t, capFakeValidator{subject: "koala-cli"}, []string{"koala-cli"})
-	resp := captureCall(t, srv, "Bearer jwt-token", map[string]any{
-		"context":  map[string]any{"harness": "claude-code", "actor": "mathias", "classification": "internal"},
-		"insights": []map[string]any{{"text": "Capture provenance probe", "wing": "hyperguild", "hall": "facts"}},
-	})
-	require.Nil(t, resp["error"], "got error: %v", resp["error"])
-	matches, err := filepath.Glob(filepath.Join(brainDir, "wiki/hyperguild/facts/*.md"))
-	require.NoError(t, err)
-	require.Len(t, matches, 1)
-	b, err := os.ReadFile(matches[0])
-	require.NoError(t, err)
-	fm := frontmatterOf(string(b))
-	assert.Contains(t, fm, "origin: jwt\n")
-	assert.Contains(t, fm, "written_by: koala-cli\n")
-}
@@ -1,42 +0,0 @@
-package mcp
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs/brainfstest"
-)
-
-// hyperguild#157 slice 2: readExcerpt (brain_context) read by path, so a
-// symlink in the Syncthing-shared brain put an outside file in context, and
-// a FIFO hung it. It now reads through brainfs.
-func TestReadExcerptRefusesSymlinksAndSurvivesSwapRaces(t *testing.T) {
-	brain := t.TempDir()
-	facts := filepath.Join(brain, "wiki", "w", "facts")
-	require.NoError(t, os.MkdirAll(facts, 0o755))
-	require.NoError(t, os.Symlink(brainfstest.Outside(t), filepath.Join(facts, "leak.md")))
-	assert.NotContains(t, readExcerpt(brain, "wiki/w/facts/leak.md", 500), brainfstest.Sentinel)
-	// A link to a file elsewhere in the brain: os.Root allows it, only the
-	// regular-file check refuses it (hyperguild#171).
-	inBrain := brainfstest.WriteSentinelAt(t, filepath.Join(brain, "raw", "s.md"))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "..", "raw", "s.md"), filepath.Join(facts, "inlink.md")))
-	assert.NotContains(t, readExcerpt(brain, "wiki/w/facts/inlink.md", 500), brainfstest.Sentinel)
-
-	p := filepath.Join(facts, "r.md")
-	require.NoError(t, os.WriteFile(p, []byte("---\nx: y\n---\ninside"), 0o644))
-	assert.Equal(t, "inside", readExcerpt(brain, "wiki/w/facts/r.md", 500))
-	brainfstest.AssertNoLeak(t, p, "---\nx: y\n---\ninside", 1500*time.Millisecond, func() string {
-		return readExcerpt(brain, "wiki/w/facts/r.md", 500)
-	})
-	brainfstest.AssertNoLeakFrom(t, p, "---\nx: y\n---\ninside", inBrain, 1500*time.Millisecond, func() string {
-		return readExcerpt(brain, "wiki/w/facts/r.md", 500)
-	})
-	brainfstest.AssertNoHang(t, p, "---\nx: y\n---\ninside", 1500*time.Millisecond, 6*time.Second, func() {
-		_ = readExcerpt(brain, "wiki/w/facts/r.md", 500)
-	})
-}
@@ -16,7 +16,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
-	"time"

 	"github.com/mathiasbq/hyperguild/ingestion/internal/brainstore"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/capture"
@@ -230,9 +229,7 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 				ctx = withPrincipal(ctx, principal, viaStatic)
 			}
 		}
-		start := time.Now()
 		out, err := s.handleCall(ctx, p.Name, p.Arguments)
-		logToolCall(ctx, p.Name, p.Arguments, start, err)
 		if err != nil {
 			rpcErr = &rpcError{Code: -32000, Message: err.Error()}
 			break
@@ -90,7 +90,6 @@ func (s *Server) brainCapture(ctx context.Context, args json.RawMessage) (json.R
 	// Principal and origin are server-derived — never taken from the body.
 	in.Context.Principal = info.principal
 	in.Context.Origin = s.capture.resolver.Resolve(info.principal, info.viaStatic)
-	in.Context.AuthPath, _ = provenanceFrom(ctx)

 	rec, err := s.capture.svc.Capture(ctx, in)
 	if err != nil {
@@ -100,17 +99,3 @@ func (s *Server) brainCapture(ctx context.Context, args json.RawMessage) (json.R
 	}
 	return json.Marshal(rec)
 }
-
-// provenanceFrom maps the authenticated principal in ctx to the provenance
-// stamped on a brain write (hyperguild#145). No principal → "unknown", never
-// silence: an unstamped note must not read as trusted.
-func provenanceFrom(ctx context.Context) (origin, writtenBy string) {
-	info, ok := ctx.Value(principalKey).(principalInfo)
-	if !ok {
-		return "unknown", ""
-	}
-	if info.viaStatic {
-		return "static", info.principal
-	}
-	return "jwt", info.principal
-}
@@ -4,7 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
+	"os"
 	"path/filepath"
 	"sort"
 	"strings"
@@ -181,13 +181,8 @@ func readExcerpt(brainDir, relPath string, maxLen int) string {
 	if relPath == "" {
 		return ""
 	}
-	// Through the brain root, regular files only (hyperguild#157).
-	bfs, err := brainfs.Open(brainDir)
-	if err != nil {
-		return ""
-	}
-	defer func() { _ = bfs.Close() }()
-	content, err := bfs.ReadRegular(filepath.ToSlash(relPath))
+	full := filepath.Join(brainDir, filepath.FromSlash(relPath))
+	content, err := os.ReadFile(full)
 	if err != nil {
 		return ""
 	}
@@ -5,8 +5,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
 	"log/slog"
 	"strings"
 	"time"
@@ -15,7 +13,6 @@ import (
 	"github.com/mathiasbq/hyperguild/ingestion/internal/capture"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/claim"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/classification"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/frontmatter"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/notes"
 )

@@ -105,57 +102,11 @@ type brainEditArgs struct {
 // hard the change is to reconstruct. Auditing every note edit would also bury
 // the rare governance record under routine traffic, which is how an alert
 // stops being read.
-func (s *Server) brainEdit(ctx context.Context, args json.RawMessage) (json.RawMessage, error) {
-	// Snapshot before editing: if the edited note cannot be stamped and
-	// verified, the edit is rolled back rather than left on disk unattributed
-	// (or carrying whatever provenance the edit wrote).
-	var a brainEditArgs
-	if err := json.Unmarshal(args, &a); err != nil {
-		return nil, fmt.Errorf("parse args: %w", err)
-	}
-	target, err := notes.Resolve(s.brainDir, a.Path, notes.ScopeNotes)
-	if err != nil {
-		return nil, err
-	}
-	// No snapshot, no edit: without one a failed stamp could not be undone.
-	// Read through the brain root, regular files only (hyperguild#192): a
-	// FIFO held open by a writer hung os.ReadFile.
-	bfs, err := brainfs.Open(s.brainDir)
-	if err != nil {
-		return nil, fmt.Errorf("snapshot before edit: %w", err)
-	}
-	defer func() { _ = bfs.Close() }()
-	prior, err := bfs.ReadRegular(target.Rel)
-	if err != nil {
-		return nil, fmt.Errorf("snapshot before edit: %w", err)
-	}
-	res, out, err := s.editWithScope(args, notes.ScopeNotes)
-	if err != nil {
-		return out, err
-	}
-	// A byte-level replace can rewrite any line, including provenance, and
-	// whoever edits a note is the author of what a reader now sees: re-stamp
-	// to the editor after every edit (PR #147 review, escape E1).
-	origin, writtenBy := provenanceFrom(ctx)
-	if beforeStampHook != nil {
-		beforeStampHook()
-	}
-	if serr := api.StampProvenanceFile(s.brainDir, res.Path, origin, writtenBy); serr != nil {
-		if werr := bfs.WriteRegular(target.Rel, prior); werr != nil {
-			// Say exactly what state the note is in: edited, unverified.
-			return nil, fmt.Errorf("stamp provenance failed (%v) AND the edit could NOT be rolled back: %w; "+
-				"%s carries the edit under its previous attribution", serr, werr, res.Path)
-		}
-		return nil, fmt.Errorf("edit rolled back, stamp provenance: %w", serr)
-	}
-	return out, nil
+func (s *Server) brainEdit(_ context.Context, args json.RawMessage) (json.RawMessage, error) {
+	_, out, err := s.editWithScope(args, notes.ScopeNotes)
+	return out, err
 }

-// beforeStampHook is a test seam (nil in production): it runs between the
-// edit and the provenance stamp, so a test can swap the note before the
-// rollback path runs.
-var beforeStampHook func()
-
 // brainEditRoot edits a governance file (CLAUDE.md). De-surfaced AND gated on
 // the authenticated principal: only the static local-CLI token may call it, so
 // a claude.ai-origin session — the one that may have just read an untrusted
@@ -380,20 +331,27 @@ func checkClaimEnvelope(brainDir, path, oldStr, newStr string) error {
 // frontmatterBlock returns the raw text between doc's opening and closing
 // `---` fences, or ok=false if doc has no (properly closed) fence.
 func frontmatterBlock(doc string) (block string, ok bool) {
-	// hyperguild#138: fence detection itself is frontmatter.Split, shared
-	// with internal/api and internal/frontmatter — the CRLF/BOM guards that
-	// used to live here (added piecemeal across rounds 4 and 5 of #123's
-	// review) are now the shared parser's job, so every caller inherits a
-	// fix instead of needing bug-for-bug parity edits.
-	b, _, ok := frontmatter.Split([]byte(doc))
-	if !ok {
+	// Round 4 found a note with CRLF fence lines ("---\r\n") silently
+	// defeats HasPrefix(doc, "---\n") on the precondition read — not an
+	// adversarial old_str/new_str, just an encoding difference — which
+	// makes checkClaimEnvelope no-op entirely. Round 5 found the same
+	// mechanism one layer earlier: a leading UTF-8 BOM (a live, plausible
+	// byte sequence — Notepad's default "UTF-8" save and PowerShell's
+	// pre-v6 Out-File/Set-Content both emit one) defeats the same prefix
+	// check before CRLF normalization even applies. Strip both, here, so
+	// every caller (hadFence/hasFence detection and frontmatterScalars)
+	// agrees regardless of encoding.
+	doc = strings.TrimPrefix(doc, "\xef\xbb\xbf")
+	doc = strings.ReplaceAll(doc, "\r\n", "\n")
+	if !strings.HasPrefix(doc, "---\n") {
 		return "", false
 	}
-	// Split's block keeps the "\n" immediately before the closing fence
-	// (by design — see its own doc comment); this function never included
-	// it. Split guarantees ok=true only when "\n---\n" matched, so this is
-	// always exactly one byte, never ambiguous.
-	return strings.TrimSuffix(string(b), "\n"), true
+	rest := doc[len("---\n"):]
+	end := strings.Index(rest, "\n---\n")
+	if end < 0 {
+		return "", false
+	}
+	return rest[:end], true
 }

 // frontmatterScalars extracts top-level "key: value" scalar pairs from
@@ -66,11 +66,8 @@ func TestBrainReadAndEdit_RoundTripThroughJSONRPC(t *testing.T) {

 	got, err := os.ReadFile(filepath.Join(dir, "wiki/homelab/facts/n.md"))
 	require.NoError(t, err)
-	// Only the matched bytes change in the body; the one deliberate addition
-	// is the editor's provenance stamp (hyperguild#145 — no principal here,
-	// so origin: unknown).
-	assert.Equal(t, "---\ntitle: 'n'\norigin: unknown\n---\n\nalpha\nBETA\n", string(got),
-		"only the matched bytes and the provenance stamp may change")
+	assert.Equal(t, "---\ntitle: 'n'\n---\n\nalpha\nBETA\n", string(got),
+		"only the matched bytes may change")
 }

 func TestBrainEdit_EmptyOldStrErrorNamesRawArgumentBytes(t *testing.T) {
@@ -5,7 +5,6 @@ import (
 	"encoding/hex"
 	"errors"
 	"fmt"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
 	"os"
 	"path/filepath"
 	"strings"
@@ -72,18 +71,14 @@ func ReadScoped(brainDir, path string, scope Scope) ([]byte, error) {
 }

 func readContained(t Target) ([]byte, error) {
-	// Through the brain root, regular files only, size checked on the opened
-	// handle (hyperguild#157): Resolve's Lstat could be raced by a swap, and
-	// os.ReadFile blocked on a FIFO.
-	bfs, err := brainfs.Open(t.Brain)
+	fi, err := os.Stat(t.Abs)
 	if err != nil {
-		return nil, fmt.Errorf("notes: %w", err)
+		return nil, fmt.Errorf("notes: stat %s: %w", t.Rel, err)
 	}
-	defer func() { _ = bfs.Close() }()
-	b, err := bfs.ReadRegularMax(t.Rel, maxNoteBytes)
-	if errors.Is(err, brainfs.ErrTooLarge) {
-		return nil, fmt.Errorf("%w: %s (limit %d)", ErrTooLarge, t.Rel, maxNoteBytes)
+	if fi.Size() > maxNoteBytes {
+		return nil, fmt.Errorf("%w: %s is %d bytes (limit %d)", ErrTooLarge, t.Rel, fi.Size(), maxNoteBytes)
 	}
+	b, err := os.ReadFile(t.Abs)
 	if err != nil {
 		return nil, fmt.Errorf("notes: read %s: %w", t.Rel, err)
 	}
@@ -127,7 +122,7 @@ func Edit(brainDir, path, oldStr, newStr string, scope Scope) (Result, error) {
 	mu.Lock()
 	defer mu.Unlock()

-	unlock, err := flockFile(t)
+	unlock, err := flockFile(t.Abs)
 	if err != nil {
 		return Result{}, err
 	}
@@ -220,49 +215,21 @@ func lockFor(abs string) *sync.Mutex {
 }

 // flockFile takes an advisory lock covering other processes sharing the
-// hostPath — during a RollingUpdate two ingestion pods do. The lock file is
-// opened and removed through the brain root, never through a symlink
-// (hyperguild#192): a planted dangling "<note>.lock" link made a successful
-// edit create a file at its target.
-//
-// Unlock removes the lock file while still holding the flock, so a waiter
-// can wake holding a lock on an orphaned inode while the next caller locks a
-// fresh file: two editors at once (measured on main). After taking the
-// flock, the file must still be the one at the path; otherwise retry.
-func flockFile(t Target) (func(), error) {
-	lockRel := t.Rel + ".lock"
-	bfs, err := brainfs.Open(t.Brain)
+// hostPath — during a RollingUpdate two ingestion pods do.
+func flockFile(abs string) (func(), error) {
+	f, err := os.OpenFile(abs+".lock", os.O_CREATE|os.O_RDWR, 0o644)
 	if err != nil {
-		return nil, fmt.Errorf("notes: lock %s: %w", lockRel, err)
+		return nil, fmt.Errorf("notes: lock %s: %w", filepath.Base(abs), err)
 	}
-	for attempt := 0; attempt < 1000; attempt++ {
-		f, err := bfs.OpenLock(lockRel)
-		if errors.Is(err, brainfs.ErrLockChanged) {
-			continue
-		}
-		if err != nil {
-			_ = bfs.Close()
-			return nil, fmt.Errorf("notes: lock %s: %w", lockRel, err)
-		}
-		if err := syscall.Flock(int(f.Fd()), syscall.LOCK_EX); err != nil {
-			_ = f.Close()
-			_ = bfs.Close()
-			return nil, fmt.Errorf("notes: flock %s: %w", lockRel, err)
-		}
-		if !bfs.LockIsCurrent(lockRel, f) {
-			_ = syscall.Flock(int(f.Fd()), syscall.LOCK_UN)
-			_ = f.Close()
-			continue
-		}
-		return func() {
-			_ = bfs.Remove(lockRel)
-			_ = syscall.Flock(int(f.Fd()), syscall.LOCK_UN)
-			_ = f.Close()
-			_ = bfs.Close()
-		}, nil
+	if err := syscall.Flock(int(f.Fd()), syscall.LOCK_EX); err != nil {
+		_ = f.Close()
+		return nil, fmt.Errorf("notes: flock %s: %w", filepath.Base(abs), err)
 	}
-	_ = bfs.Close()
-	return nil, fmt.Errorf("notes: lock %s: kept changing while locking", lockRel)
+	return func() {
+		_ = syscall.Flock(int(f.Fd()), syscall.LOCK_UN)
+		_ = f.Close()
+		_ = os.Remove(abs + ".lock")
+	}, nil
 }

 // writeAtomic replaces the file via a same-directory temp + rename, then
@@ -1,36 +0,0 @@
-package notes
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// hyperguild#188/#173: brain_edit's atomic rename must not be redirected by
-// a symlinked directory inside the brain.
-func TestEditRefusesANoteBehindASymlinkedDirectory(t *testing.T) {
-	b := t.TempDir()
-	// Edit refuses a tree that is not the sync source before any path
-	// check, so the test needs a .git to reach the symlink refusal.
-	require.NoError(t, os.MkdirAll(filepath.Join(b, ".git"), 0o755))
-	victim := filepath.Join(b, "raw", "facts", "v.md")
-	require.NoError(t, os.MkdirAll(filepath.Dir(victim), 0o755))
-	require.NoError(t, os.WriteFile(victim, []byte("old text\n"), 0o644))
-	require.NoError(t, os.MkdirAll(filepath.Join(b, "wiki", "w"), 0o755))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "raw", "facts"), filepath.Join(b, "wiki", "w", "alias")))
-	_, err := Edit(b, "wiki/w/alias/v.md", "old text", "new text", ScopeNotes)
-	assert.Error(t, err)
-	got, _ := os.ReadFile(victim)
-	assert.Equal(t, "old text\n", string(got))
-
-	real := filepath.Join(b, "wiki", "w", "facts", "r.md")
-	require.NoError(t, os.MkdirAll(filepath.Dir(real), 0o755))
-	require.NoError(t, os.WriteFile(real, []byte("old text\n"), 0o644))
-	_, err = Edit(b, "wiki/w/facts/r.md", "old text", "new text", ScopeNotes)
-	require.NoError(t, err, "positive control: a note in a real directory is edited")
-	got, _ = os.ReadFile(real)
-	assert.Equal(t, "new text\n", string(got))
-}
@@ -1,82 +0,0 @@
-package notes
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-// lockChild runs inside a re-executed test binary: it takes the note's edit
-// lock N times and, while holding it, creates an O_EXCL marker. Finding the
-// marker already there means another process holds the "same" lock: mutual
-// exclusion failed. It prints the overlap count.
-func lockChild(brainDir string, rounds int) {
-	t, err := Resolve(brainDir, "wiki/w/facts/n.md", ScopeNotes)
-	if err != nil {
-		fmt.Println("resolve:", err)
-		os.Exit(2)
-	}
-	marker := filepath.Join(brainDir, "marker")
-	overlaps := 0
-	for i := 0; i < rounds; i++ {
-		unlock, err := flockFile(t)
-		if err != nil {
-			fmt.Println("lock:", err)
-			os.Exit(2)
-		}
-		f, err := os.OpenFile(marker, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o644)
-		if errors.Is(err, os.ErrExist) {
-			overlaps++
-		} else if err == nil {
-			_ = f.Close()
-			_ = os.Remove(marker)
-		}
-		unlock()
-	}
-	fmt.Println(overlaps)
-	os.Exit(0)
-}
-
-func TestMain(m *testing.M) {
-	if dir := os.Getenv("NOTES_LOCK_CHILD"); dir != "" {
-		n, _ := strconv.Atoi(os.Getenv("NOTES_LOCK_ROUNDS"))
-		lockChild(dir, n)
-	}
-	os.Exit(m.Run())
-}
-
-// hyperguild#192: the edit lock must exclude other processes (two ingestion
-// pods share the hostPath brain during a RollingUpdate). Unlock removes the
-// lock file, so without re-checking that the locked file is still the one at
-// the path, a waiter and the next caller each held a lock (measured on main:
-// hundreds of overlaps in 2000 rounds).
-func TestEditLockExcludesOtherProcesses(t *testing.T) {
-	brain := t.TempDir()
-	require.NoError(t, os.MkdirAll(filepath.Join(brain, "wiki", "w", "facts"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(brain, "wiki", "w", "facts", "n.md"), []byte("x"), 0o644))
-	const procs, rounds = 3, 400
-	cmds := make([]*exec.Cmd, procs)
-	outs := make([]*strings.Builder, procs)
-	for i := range cmds {
-		outs[i] = &strings.Builder{}
-		cmds[i] = exec.Command(os.Args[0], "-test.run=^$")
-		cmds[i].Env = append(os.Environ(), "NOTES_LOCK_CHILD="+brain, "NOTES_LOCK_ROUNDS="+strconv.Itoa(rounds))
-		cmds[i].Stdout, cmds[i].Stderr = outs[i], outs[i]
-		require.NoError(t, cmds[i].Start())
-	}
-	total := 0
-	for i, c := range cmds {
-		require.NoError(t, c.Wait(), "child %d: %s", i, outs[i].String())
-		n, err := strconv.Atoi(strings.TrimSpace(outs[i].String()))
-		require.NoError(t, err, "child %d output: %q", i, outs[i].String())
-		total += n
-	}
-	require.Zero(t, total, "processes held the edit lock at the same time")
-}
@@ -58,9 +58,8 @@ var (

 // Target is a resolved, contained path.
 type Target struct {
-	Rel   string // brain-relative, cleaned
-	Abs   string // absolute, symlink-checked
-	Brain string // the brain root Rel is relative to
+	Rel string // brain-relative, cleaned
+	Abs string // absolute, symlink-checked
 }

 // Resolve canonicalises path, then checks it against the scope's allowlist,
@@ -110,7 +109,7 @@ func Resolve(brainDir, path string, scope Scope) (Target, error) {
 		return Target{}, err
 	}

-	return Target{Rel: clean, Abs: abs, Brain: brainDir}, nil
+	return Target{Rel: clean, Abs: abs}, nil
 }

 // allow enforces the scope's allowlist. The two scopes are DISJOINT, not
@@ -1,68 +0,0 @@
-package notes
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs/brainfstest"
-)
-
-// hyperguild#157 slice 2: ReadScoped (brain_read) Lstat-checked the final
-// component, then reopened by name with os.ReadFile: a swap after the check
-// was followed, and a FIFO blocked the read. It now reads through brainfs.
-func TestReadScopedRefusesSymlinksAndSurvivesSwapRaces(t *testing.T) {
-	brain := t.TempDir()
-	facts := filepath.Join(brain, "wiki", "w", "facts")
-	require.NoError(t, os.MkdirAll(facts, 0o755))
-	p := filepath.Join(facts, "r.md")
-	read := func() string {
-		b, _ := ReadScoped(brain, "wiki/w/facts/r.md", ScopeNotes)
-		return string(b)
-	}
-	require.NoError(t, os.WriteFile(p, []byte("inside"), 0o644))
-	assert.Equal(t, "inside", read())
-	brainfstest.AssertNoLeak(t, p, "inside", 1500*time.Millisecond, read)
-	brainfstest.AssertNoHang(t, p, "inside", 1500*time.Millisecond, 6*time.Second, func() { _ = read() })
-}
-
-func TestReadScopedRefusesANoteOverMaxNoteBytes(t *testing.T) {
-	brain := t.TempDir()
-	facts := filepath.Join(brain, "wiki", "w", "facts")
-	require.NoError(t, os.MkdirAll(facts, 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(facts, "big.md"), make([]byte, maxNoteBytes+1), 0o644))
-	_, err := ReadScoped(brain, "wiki/w/facts/big.md", ScopeNotes)
-	assert.ErrorIs(t, err, ErrTooLarge)
-}
-
-// hyperguild#171 (review of #172, finding 1): os.Root alone refuses links that
-// leave the brain, so the outside-target race above stays green for a reader
-// that skips brainfs's Lstat and SameFile checks. An in-brain target (raw/,
-// outside ScopeNotes) is what tells them apart.
-func TestReadScopedDoesNotReturnAnInBrainSymlinkTargetStaticallyOrDuringASampledSwapRace(t *testing.T) {
-	brain := t.TempDir()
-	facts := filepath.Join(brain, "wiki", "w", "facts")
-	require.NoError(t, os.MkdirAll(facts, 0o755))
-	target := brainfstest.WriteSentinelAt(t, filepath.Join(brain, "raw", "s.md"))
-
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "..", "raw", "s.md"), filepath.Join(facts, "inlink.md")))
-	b, err := ReadScoped(brain, "wiki/w/facts/inlink.md", ScopeNotes)
-	assert.Error(t, err, "static in-brain link")
-	assert.NotContains(t, string(b), brainfstest.Sentinel, "static in-brain link")
-
-	p := filepath.Join(facts, "r.md")
-	require.NoError(t, os.WriteFile(p, []byte("inside"), 0o644))
-	b, err = ReadScoped(brain, "wiki/w/facts/r.md", ScopeNotes)
-	require.NoError(t, err)
-	assert.Equal(t, "inside", string(b), "positive control: a regular note reads")
-
-	read := func() string {
-		b, _ := ReadScoped(brain, "wiki/w/facts/r.md", ScopeNotes)
-		return string(b)
-	}
-	brainfstest.AssertNoLeakFrom(t, p, "inside", target, 1500*time.Millisecond, read)
-}
@@ -3,10 +3,7 @@ package pipeline

 import (
 	"context"
-	"errors"
 	"fmt"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
-	"io/fs"
 	"os"
 	"path/filepath"
 	"strings"
@@ -26,16 +23,10 @@ func BackfillRefs(ctx context.Context, brainDir string) (int, error) {
 		return 0, fmt.Errorf("load inventory: %w", err)
 	}

-	// Listed and read through the brain root, regular files only
-	// (hyperguild#157).
-	bfs, err := brainfs.Open(brainDir)
+	sourcesDir := filepath.Join(brainDir, "wiki", "sources")
+	entries, err := os.ReadDir(sourcesDir)
 	if err != nil {
-		return 0, fmt.Errorf("open brain: %w", err)
-	}
-	defer func() { _ = bfs.Close() }()
-	names, err := bfs.ReadDirRegular("wiki/sources")
-	if err != nil {
-		if errors.Is(err, fs.ErrNotExist) {
+		if os.IsNotExist(err) {
 			return 0, nil
 		}
 		return 0, fmt.Errorf("read sources dir: %w", err)
@@ -46,20 +37,20 @@ func BackfillRefs(ctx context.Context, brainDir string) (int, error) {
 	// get both refs merged before a single write.
 	pending := make(map[string]wiki.Page)

-	for _, name := range names {
+	for _, e := range entries {
 		if ctx.Err() != nil {
 			return 0, ctx.Err()
 		}
-		if !strings.HasSuffix(name, ".md") {
+		if e.IsDir() || !strings.HasSuffix(e.Name(), ".md") {
 			continue
 		}

-		b, err := bfs.ReadRegular("wiki/sources/" + name)
+		b, err := os.ReadFile(filepath.Join(sourcesDir, e.Name()))
 		if err != nil {
 			continue
 		}
 		sourceContent := string(b)
-		sourceSlug := strings.TrimSuffix(name, ".md")
+		sourceSlug := strings.TrimSuffix(e.Name(), ".md")
 		sourceTitle := extractTitle(sourceContent)
 		if sourceTitle == "" {
 			sourceTitle = sourceSlug
@@ -79,7 +70,7 @@ func BackfillRefs(ctx context.Context, brainDir string) (int, error) {
 			// Start from already-accumulated version if we've seen this page.
 			page, seen := pending[relPath]
 			if !seen {
-				raw, err := bfs.ReadRegular(relPath)
+				raw, err := os.ReadFile(filepath.Join(brainDir, filepath.FromSlash(relPath)))
 				if err != nil {
 					continue
 				}
@@ -3,7 +3,6 @@ package pipeline

 import (
 	"fmt"
-	"regexp"
 	"strings"

 	"github.com/mathiasbq/hyperguild/ingestion/internal/wiki"
@@ -17,12 +16,6 @@ func BuildPages(rawPages []RawPage, sourceSlug, date string) ([]wiki.Page, []str
 	out := make([]wiki.Page, 0, len(rawPages))
 	var warnings []string
 	for _, rp := range rawPages {
-		// The type becomes a directory under wiki/; "../raw" wrote outside it
-		// (PR #147 review). Only a plain lower-case name is a page type.
-		if !validPageType.MatchString(rp.Type) {
-			warnings = append(warnings, fmt.Sprintf("skipped page with invalid type %q", rp.Type))
-			continue
-		}
 		slug := computeSlug(rp, sourceSlug)
 		if slug == "" {
 			warnings = append(warnings, fmt.Sprintf("skipped page with empty title (type: %s)", rp.Type))
@@ -33,8 +26,6 @@ func BuildPages(rawPages []RawPage, sourceSlug, date string) ([]wiki.Page, []str
 	return out, warnings
 }

-var validPageType = regexp.MustCompile(`^[a-z][a-z0-9-]*$`)
-
 func computeSlug(rp RawPage, sourceSlug string) string {
 	if rp.Type == "source" {
 		return sourceSlug
@@ -123,9 +114,5 @@ func buildFrontmatter(rp RawPage, date string) string {
 }

 func yamlScalar(s string) string {
-	// A raw newline or CR would end the scalar for every line-oriented
-	// frontmatter reader and start a new key (PR #147 review: a title of
-	// "x\norigin: static" forged provenance). Fold all line breaks to spaces.
-	s = strings.NewReplacer("\r\n", " ", "\r", " ", "\n", " ").Replace(s)
 	return "'" + strings.ReplaceAll(s, "'", "''") + "'"
 }
@@ -5,16 +5,12 @@ import (
 	"context"
 	"crypto/sha256"
 	"encoding/hex"
-	"errors"
 	"fmt"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
-	"io/fs"
 	"os"
 	"path/filepath"
 	"strings"
 	"time"

-	"github.com/mathiasbq/hyperguild/ingestion/internal/provenance"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/wiki"
 )

@@ -93,17 +89,13 @@ func Run(ctx context.Context, cfg Config, brainDir, content, source string, dryR
 	meta.BodyHash = bodyHash
 	applySourceMeta(allRaw, meta)

-	return buildAndWrite(ctx, allRaw, sourceSlug, date, brainDir, source, inventory, allWarnings, dryRun)
+	return buildAndWrite(allRaw, sourceSlug, date, brainDir, source, inventory, allWarnings, dryRun)
 }

 // RunRaw runs the pipeline on pre-parsed RawPages, skipping the LLM extraction
 // step. Use this when the caller has already produced the structured RawPage data
 // (e.g. from a more capable model or manual curation).
-//
-// Every page written is stamped with provenance.FromContext(ctx)
-// (hyperguild#145); a caller that knows the principal attaches it with
-// provenance.WithStamp, everyone else stamps origin: unknown.
-func RunRaw(ctx context.Context, brainDir, source string, rawPages []RawPage, dryRun bool) (Result, error) {
+func RunRaw(brainDir, source string, rawPages []RawPage, dryRun bool) (Result, error) {
 	inventory, err := wiki.LoadInventory(brainDir)
 	if err != nil {
 		return Result{}, fmt.Errorf("load inventory: %w", err)
@@ -112,11 +104,11 @@ func RunRaw(ctx context.Context, brainDir, source string, rawPages []RawPage, dr
 	sourceSlug := wiki.Slug(source)
 	date := time.Now().UTC().Format("2006-01-02")

-	return buildAndWrite(ctx, rawPages, sourceSlug, date, brainDir, source, inventory, nil, dryRun)
+	return buildAndWrite(rawPages, sourceSlug, date, brainDir, source, inventory, nil, dryRun)
 }

 // buildAndWrite runs BuildPages through write for both Run and RunRaw.
-func buildAndWrite(ctx context.Context, rawPages []RawPage, sourceSlug, date, brainDir, source string, inventory map[wiki.PageType][]wiki.Entry, warnings []string, dryRun bool) (Result, error) {
+func buildAndWrite(rawPages []RawPage, sourceSlug, date, brainDir, source string, inventory map[wiki.PageType][]wiki.Entry, warnings []string, dryRun bool) (Result, error) {
 	pages, buildWarnings := BuildPages(rawPages, sourceSlug, date)
 	warnings = append(warnings, buildWarnings...)
 	resolved := Resolve(pages, inventory)
@@ -132,7 +124,7 @@ func buildAndWrite(ctx context.Context, rawPages []RawPage, sourceSlug, date, br
 			if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
 				return Result{}, fmt.Errorf("mkdir for %s: %w", page.Path, err)
 			}
-			content, conflicts, err := reviseOrCreate(brainDir, page)
+			content, conflicts, err := reviseOrCreate(dest, page)
 			if err != nil {
 				return Result{}, err
 			}
@@ -144,13 +136,7 @@ func buildAndWrite(ctx context.Context, rawPages []RawPage, sourceSlug, date, br
 					"%s: source now disagrees on section %q — on-disk version kept",
 					page.Path, heading))
 			}
-			// Stamped as the last step, after merge/revise, so a page that
-			// was merged into is re-attributed to this ingest too.
-			stamped, err := provenance.Apply(content, provenance.FromContext(ctx))
-			if err != nil {
-				return Result{}, fmt.Errorf("stamp %s: %w", page.Path, err)
-			}
-			if err := os.WriteFile(dest, []byte(stamped), 0o644); err != nil {
+			if err := os.WriteFile(dest, []byte(content), 0o644); err != nil {
 				return Result{}, fmt.Errorf("write %s: %w", page.Path, err)
 			}
 		}
@@ -191,27 +177,14 @@ func hashBody(content string) string {

 // readSourcePage returns the full on-disk content of the source page at
 // wiki/sources/<sourceSlug>.md, or "" when it doesn't exist yet.
-// It reads through the brain root, regular files only (hyperguild#157): the
-// content goes into the LLM prompt.
 func readSourcePage(brainDir, sourceSlug string) string {
-	raw, err := readBrainFile(brainDir, "wiki/sources/"+sourceSlug+".md")
+	raw, err := os.ReadFile(filepath.Join(brainDir, "wiki", "sources", sourceSlug+".md"))
 	if err != nil {
 		return ""
 	}
 	return string(raw)
 }

-// readBrainFile reads one brain-relative file through the brain root,
-// regular files only (hyperguild#157).
-func readBrainFile(brainDir, rel string) ([]byte, error) {
-	bfs, err := brainfs.Open(brainDir)
-	if err != nil {
-		return nil, err
-	}
-	defer func() { _ = bfs.Close() }()
-	return bfs.ReadRegular(rel)
-}
-
 // storedSourceHash reads source_hash from the source page a previous ingest
 // wrote, or "" when there is no such page or no such field.
 //
@@ -246,10 +219,10 @@ func storedSourceHash(brainDir, sourceSlug string) string {
 // its first-ingest date on a revised page. Left deliberately — the alternative
 // is this function editing frontmatter it does not own, and no lint reads that
 // field today.
-func reviseOrCreate(brainDir string, page wiki.Page) (string, []string, error) {
-	existing, err := readBrainFile(brainDir, page.Path)
+func reviseOrCreate(dest string, page wiki.Page) (string, []string, error) {
+	existing, err := os.ReadFile(dest)
 	switch {
-	case errors.Is(err, fs.ErrNotExist):
+	case os.IsNotExist(err):
 		return page.Content, nil, nil
 	case err != nil:
 		return "", nil, fmt.Errorf("read existing %s: %w", page.Path, err)
@@ -283,7 +256,7 @@ See brain/schema.md for the full schema.
 `

 func loadSchema(brainDir string) string {
-	b, err := readBrainFile(brainDir, "schema.md")
+	b, err := os.ReadFile(filepath.Join(brainDir, "schema.md"))
 	if err != nil {
 		return defaultSchema
 	}
@@ -196,7 +196,7 @@ A book about shaping product work.
 Read this before the next planning cycle.
 `), 0o644))

-	_, err := RunRaw(context.Background(), dir, "shape-up", []RawPage{{
+	_, err := RunRaw(dir, "shape-up", []RawPage{{
 		Title: "Shape Up", Type: "source", Subtype: "book", Domain: "product-strategy",
 		Content: "## Summary\n\nA book about shaping product work.\n\n## Key Claims\n\n- Appetite beats estimation.\n",
 	}}, false)
@@ -221,12 +221,12 @@ func TestRunRaw_ReIngestingUnchangedContentIsByteIdentical(t *testing.T) {
 		Content: "## Summary\n\nA book about shaping product work.\n\n## Open Questions\n\n- Does appetite scale?\n",
 	}}

-	_, err := RunRaw(context.Background(), dir, "shape-up", raw, false)
+	_, err := RunRaw(dir, "shape-up", raw, false)
 	require.NoError(t, err)
 	first, err := os.ReadFile(filepath.Join(dir, "wiki", "sources", "shape-up.md"))
 	require.NoError(t, err)

-	_, err = RunRaw(context.Background(), dir, "shape-up", raw, false)
+	_, err = RunRaw(dir, "shape-up", raw, false)
 	require.NoError(t, err)
 	second, err := os.ReadFile(filepath.Join(dir, "wiki", "sources", "shape-up.md"))
 	require.NoError(t, err)
@@ -368,10 +368,7 @@ func TestRun_RevisionEchoingExistingPageStaysByteIdentical(t *testing.T) {
 	require.NoError(t, err)

 	want := "---\ntitle: 'Shape Up'\nlast_updated: " + time.Now().UTC().Format("2006-01-02") +
-		"\nsource_hash: " + hashBody(content) +
-		// Every page an ingest writes carries provenance (hyperguild#145);
-		// no stamp in ctx here, so origin: unknown.
-		"\norigin: unknown\n---\n\n" +
+		"\nsource_hash: " + hashBody(content) + "\n---\n\n" +
 		"## Summary\n\nA book about shaping product work.\n\n" +
 		"## Key Claims\n\n- Appetite beats estimation.\n"
 	assert.Equal(t, want, string(got),
@@ -412,7 +409,7 @@ title: 'Shape Up'
 Appetite is fixed, scope is variable.
 `), 0o644))

-	res, err := RunRaw(context.Background(), dir, "shape-up", []RawPage{{
+	res, err := RunRaw(dir, "shape-up", []RawPage{{
 		Title: "Shape Up", Type: "source", Subtype: "book", Domain: "product",
 		Content: "## Summary\n\nAppetite is negotiable and scope is fixed.\n",
 	}}, false)
@@ -2,6 +2,7 @@
 package pipeline

 import (
+	"os"
 	"path/filepath"
 	"regexp"
 	"strings"
@@ -52,7 +53,8 @@ func injectSourceRefs(pages []wiki.Page, inventory map[wiki.PageType][]wiki.Entr
 		if !ok {
 			continue
 		}
-		b, err := readBrainFile(brainDir, "wiki/"+string(pt)+"/"+slug+".md")
+		diskPath := filepath.Join(brainDir, "wiki", string(pt), slug+".md")
+		b, err := os.ReadFile(diskPath)
 		if err != nil {
 			continue
 		}
@@ -1,167 +0,0 @@
-package pipeline
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"syscall"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs/brainfstest"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/wiki"
-)
-
-// hyperguild#157 slice 6: the pipeline read the source page, schema.md, the
-// pages it revises and the pages it adds source refs to with os.ReadFile, so
-// a symlinked file's content reached the LLM prompt and the written pages,
-// and a FIFO hung the ingest.
-
-func mkdirs(t *testing.T, brain string, dirs ...string) {
-	t.Helper()
-	for _, d := range dirs {
-		require.NoError(t, os.MkdirAll(filepath.Join(brain, filepath.FromSlash(d)), 0o755))
-	}
-}
-
-func TestReadSourcePageAndSchemaRefuseSymlinksAndSurviveSwapRaces(t *testing.T) {
-	brain := t.TempDir()
-	mkdirs(t, brain, "wiki/sources")
-	inBrain := brainfstest.WriteSentinelAt(t, filepath.Join(brain, "raw", "s.md"))
-	require.NoError(t, os.WriteFile(filepath.Join(brain, "wiki", "sources", "ok.md"), []byte("zqinside source"), 0o644))
-	require.NoError(t, os.WriteFile(filepath.Join(brain, "schema.md"), []byte("zqinside schema"), 0o644))
-	assert.Equal(t, "zqinside source", readSourcePage(brain, "ok"), "positive control")
-	assert.Equal(t, "zqinside schema", loadSchema(brain), "positive control")
-
-	require.NoError(t, os.Symlink(brainfstest.Outside(t), filepath.Join(brain, "wiki", "sources", "out.md")))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "raw", "s.md"), filepath.Join(brain, "wiki", "sources", "in.md")))
-	assert.NotContains(t, readSourcePage(brain, "out"), brainfstest.Sentinel)
-	assert.NotContains(t, readSourcePage(brain, "in"), brainfstest.Sentinel)
-	assert.NotContains(t, storedSourceHash(brain, "in"), brainfstest.Sentinel)
-
-	src := filepath.Join(brain, "wiki", "sources", "r.md")
-	read := func() string { return readSourcePage(brain, "r") }
-	brainfstest.AssertNoLeak(t, src, "zqinside", 1500*time.Millisecond, read)
-	brainfstest.AssertNoLeakFrom(t, src, "zqinside", inBrain, 1500*time.Millisecond, read)
-	brainfstest.AssertNoHang(t, src, "zqinside", 1500*time.Millisecond, 6*time.Second, func() { _ = read() })
-
-	schema := filepath.Join(brain, "schema.md")
-	rs := func() string { return loadSchema(brain) }
-	brainfstest.AssertNoLeakFrom(t, schema, "zqinside schema", inBrain, 1500*time.Millisecond, rs)
-	brainfstest.AssertNoHang(t, schema, "zqinside schema", 1500*time.Millisecond, 6*time.Second, func() { _ = rs() })
-}
-
-func TestReviseOrCreateRefusesASymlinkedExistingPage(t *testing.T) {
-	brain := t.TempDir()
-	mkdirs(t, brain, "wiki/concepts")
-	brainfstest.WriteSentinelAt(t, filepath.Join(brain, "raw", "s.md"))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "raw", "s.md"), filepath.Join(brain, "wiki", "concepts", "c.md")))
-	page := wiki.Page{Path: "wiki/concepts/c.md", Content: "---\ntitle: C\n---\nnew\n"}
-	out, _, err := reviseOrCreate(brain, page)
-	assert.Error(t, err)
-	assert.NotContains(t, out, brainfstest.Sentinel)
-
-	require.NoError(t, os.WriteFile(filepath.Join(brain, "wiki", "concepts", "d.md"), []byte("---\ntitle: D\n---\nzqold\n"), 0o644))
-	out, _, err = reviseOrCreate(brain, wiki.Page{Path: "wiki/concepts/d.md", Content: "---\ntitle: D\n---\nnew\n"})
-	require.NoError(t, err)
-	assert.Contains(t, out, "zqold", "positive control: the existing page is read")
-	out, _, err = reviseOrCreate(brain, wiki.Page{Path: "wiki/concepts/new.md", Content: "fresh"})
-	require.NoError(t, err)
-	assert.Equal(t, "fresh", out, "positive control: a missing page is created")
-}
-
-func TestInjectSourceRefsDoesNotReadASymlinkedPage(t *testing.T) {
-	brain := t.TempDir()
-	mkdirs(t, brain, "wiki/concepts")
-	brainfstest.WriteSentinelAt(t, filepath.Join(brain, "raw", "s.md"))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "raw", "s.md"), filepath.Join(brain, "wiki", "concepts", "c.md")))
-	require.NoError(t, os.WriteFile(filepath.Join(brain, "wiki", "concepts", "d.md"), []byte("zqinside d"), 0o644))
-	inv := map[wiki.PageType][]wiki.Entry{wiki.PageTypeConcept: {
-		{Slug: "c", Type: wiki.PageTypeConcept}, {Slug: "d", Type: wiki.PageTypeConcept},
-	}}
-	src := wiki.Page{Path: "wiki/sources/src.md", Content: "---\ntitle: Src\n---\nsee [[c|C]] and [[d|D]]\n"}
-	out := injectSourceRefs([]wiki.Page{src}, inv, brain)
-	got := fmt.Sprintf("%+v", out)
-	assert.Contains(t, got, "zqinside d", "positive control")
-	assert.NotContains(t, got, brainfstest.Sentinel)
-}
-
-func TestBackfillRefsSkipsSymlinkedSourcesAndPages(t *testing.T) {
-	brain := t.TempDir()
-	mkdirs(t, brain, "wiki/sources", "wiki/concepts", "raw")
-	require.NoError(t, os.WriteFile(filepath.Join(brain, "wiki", "concepts", "real.md"), []byte("---\ntitle: R\n---\nbody\n"), 0o644))
-	require.NoError(t, os.WriteFile(filepath.Join(brain, "wiki", "sources", "ok.md"), []byte("---\ntitle: zqinside\n---\n[[real|R]]\n"), 0o644))
-	// A source elsewhere in the brain whose title is the sentinel and which
-	// links the real concept with the [[slug|title]] form the pipeline follows.
-	require.NoError(t, os.WriteFile(filepath.Join(brain, "raw", "src.md"),
-		[]byte("---\ntitle: "+brainfstest.Sentinel+"\n---\n[[real|R]]\n"), 0o644))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "raw", "src.md"), filepath.Join(brain, "wiki", "sources", "in.md")))
-	// A concept page linked by the regular source that is itself a symlink.
-	require.NoError(t, os.WriteFile(filepath.Join(brain, "wiki", "sources", "ok2.md"), []byte("---\ntitle: Two\n---\n[[lnk|L]]\n"), 0o644))
-	brainfstest.WriteSentinelAt(t, filepath.Join(brain, "raw", "page.md"))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "raw", "page.md"), filepath.Join(brain, "wiki", "concepts", "lnk.md")))
-
-	_, err := BackfillRefs(context.Background(), brain)
-	require.NoError(t, err)
-	b, _ := os.ReadFile(filepath.Join(brain, "wiki", "concepts", "real.md"))
-	assert.Contains(t, string(b), "zqinside", "positive control: the regular source's ref is added")
-	assert.NotContains(t, string(b), brainfstest.Sentinel, "a symlinked source's title was written as a ref")
-	raw, _ := os.ReadFile(filepath.Join(brain, "raw", "page.md"))
-	assert.NotContains(t, string(raw), "[[ok2", "the symlinked concept page's target was rewritten")
-}
-
-// A source swapped between a regular file and a symlink to an in-brain source
-// whose title is the sentinel: the read refuses the swapped-in link, so the
-// sentinel never lands in the concept page as a ref.
-func TestBackfillRefsDoesNotWriteARefFromASourceSwappedInBehindASymlink(t *testing.T) {
-	brain := t.TempDir()
-	mkdirs(t, brain, "wiki/sources", "wiki/concepts", "raw")
-	realPage := filepath.Join(brain, "wiki", "concepts", "real.md")
-	target := filepath.Join(brain, "raw", "src.md")
-	require.NoError(t, os.WriteFile(target, []byte("---\ntitle: "+brainfstest.Sentinel+"\n---\n[[real|R]]\n"), 0o644))
-	src := filepath.Join(brain, "wiki", "sources", "r.md")
-	inside := "---\ntitle: zqinside\n---\n[[real|R]]\n"
-	read := func() string {
-		_ = os.WriteFile(realPage, []byte("---\ntitle: R\n---\nbody\n"), 0o644)
-		_, _ = BackfillRefs(context.Background(), brain)
-		b, _ := os.ReadFile(realPage)
-		return string(b)
-	}
-	require.NoError(t, os.WriteFile(src, []byte(inside), 0o644))
-	require.Contains(t, read(), "zqinside", "positive control")
-	brainfstest.AssertNoLeakFrom(t, src, inside, target, 1500*time.Millisecond, read)
-}
-
-// A concept page that is regular when the inventory lists it, then swapped
-// for a symlink to an in-brain file before BackfillRefs reads it: only the
-// page read's own check refuses it (a static symlink never gets this far,
-// because LoadInventory does not list it).
-func TestBackfillRefsDoesNotCopyAPageSwappedInBehindASymlink(t *testing.T) {
-	brain := t.TempDir()
-	mkdirs(t, brain, "wiki/sources", "wiki/concepts", "raw")
-	require.NoError(t, os.WriteFile(filepath.Join(brain, "wiki", "sources", "s.md"), []byte("---\ntitle: S\n---\n[[c|C]]\n"), 0o644))
-	page := filepath.Join(brain, "wiki", "concepts", "c.md")
-	target := filepath.Join(brain, "raw", "secret.md")
-	inside := "---\ntitle: C\n---\nzqinside\n"
-	read := func() string {
-		// The write path still follows a swapped-in link (#158) and can
-		// overwrite the target, so restore it each round.
-		_ = os.WriteFile(target, []byte("---\ntitle: X\n---\n"+brainfstest.Sentinel+"\n"), 0o644)
-		_, _ = BackfillRefs(context.Background(), brain)
-		f, err := os.OpenFile(page, os.O_RDONLY|syscall.O_NOFOLLOW|syscall.O_NONBLOCK, 0)
-		if err != nil {
-			return ""
-		}
-		defer func() { _ = f.Close() }()
-		b, _ := io.ReadAll(f)
-		return string(b)
-	}
-	require.NoError(t, os.WriteFile(page, []byte(inside), 0o644))
-	require.Contains(t, read(), "[[s|S]]", "positive control: the regular page gets the source ref")
-	brainfstest.AssertNoLeakFrom(t, page, inside, target, 3*time.Second, read)
-}
@@ -1,206 +0,0 @@
-// Package provenance stamps server-owned write provenance (hyperguild#145)
-// into a brain note's frontmatter: origin (static | jwt | unknown) and
-// written_by (the authenticated principal), so a reader can discount what a
-// connector session wrote after reading an untrusted page.
-//
-// The control is a post-condition applied by every write path a model can
-// reach. Two review rounds on PR #147 showed that deciding line by line which
-// lines are provenance loses to YAML's context-dependent features — an alias
-// key resolves only against an anchor elsewhere, and a `...` line ends the
-// document before the stamp. So Apply does not try to recognise provenance.
-// It keeps only frontmatter it can prove is plain:
-//
-//   - a top-level line `key: value` whose key is a bare identifier,
-//   - together with that key's continuation lines (indented, or `- ` items
-//     after an empty value),
-//   - where the group decodes ON ITS OWN, with yaml.v3, to a mapping with
-//     exactly that one key,
-//   - and the key is not origin/written_by and has not been seen before.
-//
-// Everything else — aliases, anchors used as keys, document markers, complex
-// keys, merge keys, flow maps, tags, quoted keys, duplicates — is dropped.
-// Then the stamp is appended and the whole result is decoded by yaml.v3 as a
-// backstop: if it does not decode to exactly the stamped values, Apply fails
-// and the caller refuses the write.
-package provenance
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"regexp"
-	"strings"
-
-	"gopkg.in/yaml.v3"
-
-	sharedfm "github.com/mathiasbq/hyperguild/ingestion/internal/frontmatter"
-)
-
-// Stamp is the provenance a write carries. An empty Origin means "unknown".
-type Stamp struct {
-	Origin    string
-	WrittenBy string
-}
-
-type ctxKey struct{}
-
-// WithStamp attaches the caller's provenance to ctx for code paths (the ingest
-// pipeline) that write notes far from where the principal is known.
-func WithStamp(ctx context.Context, s Stamp) context.Context {
-	return context.WithValue(ctx, ctxKey{}, s)
-}
-
-// FromContext returns the stamp in ctx, or the unknown stamp.
-func FromContext(ctx context.Context) Stamp {
-	if s, ok := ctx.Value(ctxKey{}).(Stamp); ok {
-		return s
-	}
-	return Stamp{}
-}
-
-// ErrUnverifiable means the stamped note would not read back as stamped.
-var ErrUnverifiable = errors.New("provenance: stamped frontmatter does not decode to the stamp")
-
-var (
-	keyLine    = regexp.MustCompile(`^([A-Za-z_][A-Za-z0-9_.-]*)[ ]*:(?:[ ]|$)(.*)$`)
-	bareScalar = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._@-]*$`)
-	reserved   = map[string]bool{"origin": true, "written_by": true}
-)
-
-func (s Stamp) origin() string {
-	if s.Origin == "" {
-		return "unknown"
-	}
-	return s.Origin
-}
-
-// Apply returns content with its frontmatter reduced to plain groups and the
-// stamp appended. Content without frontmatter gains a block.
-func Apply(content string, s Stamp) (string, error) {
-	stamp := "origin: " + scalar(s.origin()) + "\n"
-	if s.WrittenBy != "" {
-		stamp += "written_by: " + scalar(s.WrittenBy) + "\n"
-	}
-	content = foldFrontmatterCR(content)
-	block, rest, ok := sharedfm.Split([]byte(content))
-	var out string
-	switch {
-	case !ok && strings.HasPrefix(strings.ReplaceAll(content, "\r\n", "\n"), "---\n"):
-		// A fence was opened but cannot be closed (e.g. a "---x" line).
-		// Prepending a second block would demote the original frontmatter
-		// into the body, so refuse instead (PR #147 review round 3).
-		return "", fmt.Errorf("%w: unclosed frontmatter fence", ErrUnverifiable)
-	case !ok:
-		out = "---\n" + stamp + "---\n" + content
-	default:
-		out = "---\n" + plainGroups(string(block)) + stamp + "---\n" + strings.TrimPrefix(string(rest), "\n")
-	}
-	if err := verify(out, s); err != nil {
-		return "", err
-	}
-	return out, nil
-}
-
-// plainGroups keeps the provably plain key groups of a frontmatter block.
-func plainGroups(block string) string {
-	lines := strings.Split(strings.TrimSuffix(block, "\n"), "\n")
-	seen := map[string]bool{}
-	var b strings.Builder
-	for i := 0; i < len(lines); {
-		line := lines[i]
-		m := keyLine.FindStringSubmatch(line)
-		if m == nil {
-			i++ // not a plain key line: dropped, as is anything it would govern
-			for i < len(lines) && isContinuation(lines[i], "") {
-				i++
-			}
-			continue
-		}
-		key, value := m[1], strings.TrimSpace(m[2])
-		j := i + 1
-		for j < len(lines) && isContinuation(lines[j], value) {
-			j++
-		}
-		group := strings.Join(lines[i:j], "\n") + "\n"
-		lk := strings.ToLower(key)
-		if !reserved[lk] && !seen[lk] && decodesToOnly(group, key) {
-			seen[lk] = true
-			b.WriteString(group)
-		}
-		i = j
-	}
-	return b.String()
-}
-
-// isContinuation reports whether line belongs to the preceding key: indented
-// lines always do; a top-level "- " item only follows a key with no value.
-func isContinuation(line, value string) bool {
-	if line == "" {
-		return false
-	}
-	if line[0] == ' ' {
-		return true
-	}
-	return value == "" && strings.HasPrefix(line, "- ")
-}
-
-func decodesToOnly(group, key string) bool {
-	var m map[string]any
-	if err := yaml.Unmarshal([]byte(group), &m); err != nil {
-		return false
-	}
-	_, ok := m[key]
-	return ok && len(m) == 1
-}
-
-func verify(doc string, s Stamp) error {
-	block, _, ok := sharedfm.Split([]byte(doc))
-	if !ok {
-		return ErrUnverifiable
-	}
-	var m map[string]any
-	if err := yaml.Unmarshal(block, &m); err != nil {
-		return fmt.Errorf("%w: %v", ErrUnverifiable, err)
-	}
-	if m["origin"] != s.origin() {
-		return ErrUnverifiable
-	}
-	if s.WrittenBy == "" {
-		if _, has := m["written_by"]; has {
-			return ErrUnverifiable
-		}
-	} else if m["written_by"] != s.WrittenBy {
-		return ErrUnverifiable
-	}
-	return nil
-}
-
-// foldFrontmatterCR turns CRLF and lone CR inside a leading frontmatter block
-// into LF, so every reader agrees on where lines end.
-func foldFrontmatterCR(content string) string {
-	s := strings.ReplaceAll(content, "\r\n", "\n")
-	if !strings.HasPrefix(s, "---\n") {
-		return content
-	}
-	end := strings.Index(s[4:], "\n---")
-	if end < 0 {
-		return content
-	}
-	return strings.ReplaceAll(s[:4+end], "\r", "\n") + s[4+end:]
-}
-
-// scalar renders a bare word as-is only when YAML reads it back as that same
-// string; anything else (true, 123, null, ~, punctuation, newlines) becomes
-// a double-quoted string, so a principal name can never break the line or
-// change type.
-func scalar(v string) string {
-	if bareScalar.MatchString(v) {
-		var back any
-		if yaml.Unmarshal([]byte(v), &back) == nil {
-			if s, ok := back.(string); ok && s == v {
-				return v
-			}
-		}
-	}
-	return fmt.Sprintf("%q", v)
-}
@@ -1,86 +0,0 @@
-package provenance
-
-import (
-	"errors"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-	"gopkg.in/yaml.v3"
-)
-
-func fmOf(t *testing.T, doc string) map[string]any {
-	t.Helper()
-	parts := strings.SplitN(doc, "---\n", 3)
-	require.Len(t, parts, 3, doc)
-	var m map[string]any
-	require.NoError(t, yaml.Unmarshal([]byte(parts[1]), &m), parts[1])
-	return m
-}
-
-// The whole-document backstop: a stamp that would not read back as written
-// is refused, never written. A principal with an invalid UTF-8 byte quotes
-// to "\xff", which YAML decodes as U+00FF, so it cannot round-trip.
-func TestApplyRefusesAStampThatDoesNotReadBack(t *testing.T) {
-	_, err := Apply("---\ntitle: t\n---\nbody\n", Stamp{Origin: "jwt", WrittenBy: "bad\xff"})
-	assert.True(t, errors.Is(err, ErrUnverifiable), "got %v", err)
-}
-
-// A principal that YAML would decode as a non-string (true, 123, null) is
-// quoted, so the stamp reads back as the same string.
-func TestApplyQuotesPrincipalsYAMLWouldNotReadAsStrings(t *testing.T) {
-	for _, p := range []string{"true", "123", "null", "1e3", "0x1F", "yes", "~"} {
-		out, err := Apply("---\ntitle: t\n---\nbody\n", Stamp{Origin: "jwt", WrittenBy: p})
-		require.NoError(t, err, p)
-		assert.Equal(t, p, fmOf(t, out)["written_by"], p)
-	}
-}
-
-// A group that does not decode on its own is dropped; its neighbours stay.
-func TestApplyDropsGroupsThatDoNotDecodeAlone(t *testing.T) {
-	out, err := Apply("---\nkeep: 1\ntitle: a: b\nalso: 2\n---\nbody\n", Stamp{Origin: "static", WrittenBy: "local-cli"})
-	require.NoError(t, err)
-	m := fmOf(t, out)
-	assert.Equal(t, 1, m["keep"])
-	assert.Equal(t, 2, m["also"])
-	assert.NotContains(t, m, "title")
-}
-
-func TestApplyKeepsFirstOfDuplicateKeys(t *testing.T) {
-	out, err := Apply("---\ntitle: first\ntitle: second\nTitle: third\n---\nbody\n", Stamp{})
-	require.NoError(t, err)
-	m := fmOf(t, out)
-	assert.Equal(t, "first", m["title"])
-	assert.NotContains(t, m, "Title")
-}
-
-func TestApplyFoldsLoneCRSoItCannotHideALine(t *testing.T) {
-	out, err := Apply("---\ntitle: x\rorigin: static\n---\nbody\n", Stamp{Origin: "jwt", WrittenBy: "a"})
-	require.NoError(t, err)
-	assert.NotContains(t, out, "\r")
-	assert.Equal(t, "jwt", fmOf(t, out)["origin"])
-	assert.Equal(t, "x", fmOf(t, out)["title"])
-}
-
-func TestApplyDropsTabIndentedContinuations(t *testing.T) {
-	out, err := Apply("---\ntitle: x\n\torigin: static\nk: v\n---\nbody\n", Stamp{Origin: "jwt", WrittenBy: "a"})
-	require.NoError(t, err)
-	m := fmOf(t, out)
-	assert.Equal(t, "jwt", m["origin"])
-	assert.Equal(t, "v", m["k"])
-}
-
-// Content that opens a fence the shared splitter cannot close (e.g. a
-// "---x" line) is refused rather than given a second, prepended block that
-// demotes the original frontmatter into the body.
-func TestApplyRefusesAnUnclosableFrontmatterFence(t *testing.T) {
-	_, err := Apply("---\ntitle: t\n---x\norigin: static\n---\nbody\n", Stamp{Origin: "jwt", WrittenBy: "a"})
-	assert.True(t, errors.Is(err, ErrUnverifiable), "got %v", err)
-}
-
-func TestApplyAddsFrontmatterToContentWithoutAny(t *testing.T) {
-	out, err := Apply("# plain\n\norigin: static is prose\n", Stamp{Origin: "static", WrittenBy: "local-cli"})
-	require.NoError(t, err)
-	assert.True(t, strings.HasPrefix(out, "---\norigin: static\nwritten_by: local-cli\n---\n# plain"))
-}
@@ -1,239 +0,0 @@
-package search
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"syscall"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs/brainfstest"
-)
-
-// hyperguild#157 option 1: search walked and read the brain by path, so a
-// symlink anywhere in the Syncthing-shared brain dir (wiki/<w>/<h>/leak.md ->
-// /any/file) put the target's contents in brain_query results (reproduced in
-// the PR #156 review). Search now walks and reads through an os.Root on the
-// brain dir and only reads regular files.
-
-const sentinel157 = "zqsentinelonefiftyseven"
-
-func searchBrain(t *testing.T) (brain, facts, outside string) {
-	t.Helper()
-	brain = t.TempDir()
-	facts = filepath.Join(brain, "wiki", "w", "facts")
-	require.NoError(t, os.MkdirAll(facts, 0o755))
-	require.NoError(t, os.MkdirAll(filepath.Join(brain, "knowledge"), 0o755))
-	outside = filepath.Join(t.TempDir(), "secret.md")
-	require.NoError(t, os.WriteFile(outside, []byte("# secret\n\n"+sentinel157), 0o644))
-	return brain, facts, outside
-}
-
-func leaked(rs []Result) int {
-	n := 0
-	for _, r := range rs {
-		n += strings.Count(r.Excerpt+r.Title, sentinel157)
-	}
-	return n
-}
-
-func TestQueryDoesNotFollowASymlinkInTheWiki(t *testing.T) {
-	brain, facts, outside := searchBrain(t)
-	require.NoError(t, os.Symlink(outside, filepath.Join(facts, "leak.md")))
-	require.NoError(t, os.WriteFile(filepath.Join(facts, "real.md"), []byte("# real\n\nzqrealnote"), 0o644))
-	rs, err := Query(brain, QueryOptions{Query: sentinel157, Limit: 10})
-	require.NoError(t, err)
-	assert.Zero(t, leaked(rs))
-	rs, err = Query(brain, QueryOptions{Query: "zqrealnote", Limit: 10})
-	require.NoError(t, err)
-	assert.Len(t, rs, 1, "regular notes are still found")
-}
-
-func TestQueryDoesNotFollowASymlinkedDirectory(t *testing.T) {
-	brain, _, outside := searchBrain(t)
-	require.NoError(t, os.Symlink(filepath.Dir(outside), filepath.Join(brain, "wiki", "linked")))
-	rs, err := Query(brain, QueryOptions{Query: sentinel157, Limit: 10})
-	require.NoError(t, err)
-	assert.Zero(t, leaked(rs))
-}
-
-// A search root that is a symlink staying inside the brain (wiki/<w> -> ..)
-// was followed by fs.WalkDir, aliasing raw/ and root files into results
-// (PR #166 review). The root is now Lstat-checked and skipped.
-func TestQueryDoesNotFollowASymlinkedWingRootInsideTheBrain(t *testing.T) {
-	brain, _, _ := searchBrain(t)
-	require.NoError(t, os.MkdirAll(filepath.Join(brain, "raw"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(brain, "raw", "r.md"), []byte("# r\n\nzqrawonly"), 0o644))
-	require.NoError(t, os.Symlink("..", filepath.Join(brain, "wiki", "alias")))
-	rs, err := Query(brain, QueryOptions{Query: "zqrawonly", Wing: "alias", Limit: 10})
-	require.NoError(t, err)
-	assert.Empty(t, rs)
-}
-
-// With a hall the search root is wiki/<wing>/<hall>; a symlinked <wing> with
-// a real <hall> directory under its target was followed (PR #166 round 2).
-func TestQueryDoesNotFollowASymlinkedWingUnderAWingAndHallRoot(t *testing.T) {
-	brain, _, _ := searchBrain(t)
-	require.NoError(t, os.MkdirAll(filepath.Join(brain, "raw", "facts"), 0o755))
-	require.NoError(t, os.WriteFile(filepath.Join(brain, "raw", "facts", "r.md"), []byte("# r\n\nzqrawhall"), 0o644))
-	require.NoError(t, os.Symlink(filepath.Join("..", "raw"), filepath.Join(brain, "wiki", "alias")))
-	rs, err := Query(brain, QueryOptions{Query: "zqrawhall", Wing: "alias", Hall: "facts", Limit: 10})
-	require.NoError(t, err)
-	assert.Empty(t, rs)
-}
-
-// swapInto keeps renaming a regular note, and either a symlink to outside or
-// a FIFO, into path. Each FIFO has a writer held open (as any local process
-// can): a FIFO with no writer reads EOF at once, which would let a reader
-// that skips the handle check pass (PR #161 round 2: with a held writer, a
-// bypass of readOpened hung Query after 5 iterations).
-// startSwap runs swapInto until the test ends and waits for it before
-// t.TempDir's cleanup (hyperguild#162).
-// It returns the count of symlinks or FIFOs actually renamed into path
-// (hyperguild#177: a swapper whose every swap fails tests nothing).
-func startSwap(t *testing.T, path, outside string, fifo bool) *atomic.Int64 {
-	t.Helper()
-	var stop atomic.Bool
-	var swaps atomic.Int64
-	var wg sync.WaitGroup
-	wg.Add(1)
-	go func() { defer wg.Done(); swapInto(path, outside, fifo, &stop, &swaps) }()
-	t.Cleanup(func() { stop.Store(true); wg.Wait() })
-	return &swaps
-}
-
-func swapInto(path, outside string, fifo bool, stop *atomic.Bool, swaps *atomic.Int64) {
-	tmp := path + ".swap"
-	// Writers stay open until the swapper exits, so a reader parked on a
-	// FIFO stays parked (closing one would hand the reader EOF and hide the
-	// hang). Past the fd limit, new FIFOs simply have no writer.
-	var writers []*os.File
-	defer func() {
-		for _, w := range writers {
-			_ = w.Close()
-		}
-	}()
-	for i := 0; !stop.Load(); i++ {
-		_ = os.Remove(tmp)
-		var made error
-		switch {
-		case i%2 == 0:
-			_ = os.WriteFile(tmp, []byte("# r\n\nzqinside "+"zqracenote"), 0o644)
-		case fifo:
-			if made = syscall.Mkfifo(tmp, 0o644); made == nil {
-				if w, err := os.OpenFile(tmp, os.O_RDWR, 0); err == nil {
-					writers = append(writers, w)
-				}
-			}
-		default:
-			made = os.Symlink(outside, tmp)
-		}
-		if err := os.Rename(tmp, path); err == nil && made == nil && i%2 == 1 {
-			swaps.Add(1)
-		}
-	}
-}
-
-func TestQueryLeaksNothingUnderASymlinkSwapRace(t *testing.T) {
-	brain, facts, outside := searchBrain(t)
-	swaps := startSwap(t, filepath.Join(facts, "r.md"), outside, false)
-	leaks, iters, insideReads := 0, 0, 0
-	for deadline := time.Now().Add(1500 * time.Millisecond); time.Now().Before(deadline); iters++ {
-		rs, err := Query(brain, QueryOptions{Query: sentinel157, Limit: 10})
-		require.NoError(t, err)
-		leaks += leaked(rs)
-		// Positive control (hyperguild#177): a Query that always errors
-		// returns nothing and so never leaks.
-		rs, err = Query(brain, QueryOptions{Query: "zqracenote", Limit: 10})
-		require.NoError(t, err)
-		if len(rs) > 0 {
-			insideReads++
-		}
-	}
-	if leaks > 0 {
-		t.Fatalf("outside file leaked %d times in %d iterations", leaks, iters)
-	}
-	require.Positive(t, swaps.Load(), "no symlink was swapped in: the race did not run")
-	require.Positive(t, insideReads, "no Query returned the inside note")
-}
-
-func TestQueryDoesNotHangUnderAFIFOSwapRace(t *testing.T) {
-	brain, facts, outside := searchBrain(t)
-	startSwap(t, filepath.Join(facts, "r.md"), outside, true)
-	done := make(chan struct{})
-	go func() {
-		for deadline := time.Now().Add(1500 * time.Millisecond); time.Now().Before(deadline); {
-			_, _ = Query(brain, QueryOptions{Query: "zqracenote", Limit: 10})
-		}
-		close(done)
-	}()
-	select {
-	case <-done:
-	case <-time.After(6 * time.Second):
-		if f, err := os.OpenFile(filepath.Join(facts, "r.md"), os.O_WRONLY|syscall.O_NONBLOCK, 0); err == nil {
-			_ = f.Close()
-		}
-		t.Fatal("search hung on a swapped-in FIFO")
-	}
-}
-
-// hydrate (vector-only hits) reads by relative path; it must refuse a symlink.
-func TestHydrateRefusesASymlink(t *testing.T) {
-	brain, facts, outside := searchBrain(t)
-	require.NoError(t, os.Symlink(outside, filepath.Join(facts, "leak.md")))
-	r, err := hydrate(brain, "wiki/w/facts/leak.md")
-	assert.Error(t, err)
-	assert.NotContains(t, r.Excerpt, sentinel157)
-}
-
-// hyperguild#171: os.Root refuses links that leave the brain on its own, so
-// the outside-target cases above would stay green for a caller that read
-// without brainfs's Lstat and SameFile checks. These targets are inside the
-// brain (raw/, which is not a search root).
-func inBrainTarget(t *testing.T, brain string) string {
-	t.Helper()
-	return brainfstest.WriteSentinelAt(t, filepath.Join(brain, "raw", "s.md"))
-}
-
-func TestQueryDoesNotReturnAnInBrainSymlinkTargetDuringASampledSwapRace(t *testing.T) {
-	brain, facts, _ := searchBrain(t)
-	target := inBrainTarget(t, brain)
-	read := func() string {
-		// Both terms, so the regular note is a possible hit: a reader that
-		// never returns the inside note would pass vacuously (#177 floor).
-		rs, _ := Query(brain, QueryOptions{Query: brainfstest.Sentinel + " zqinside", Limit: 10})
-		s := ""
-		for _, r := range rs {
-			s += r.Title + r.Excerpt
-		}
-		return s
-	}
-	brainfstest.AssertNoLeakFrom(t, filepath.Join(facts, "r.md"), "# r\n\nzqinside", target, 1500*time.Millisecond, read)
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "..", "raw", "s.md"), filepath.Join(facts, "inlink.md")))
-	assert.NotContains(t, read(), brainfstest.Sentinel, "static in-brain link")
-}
-
-func TestHydrateRefusesAnInBrainSymlinkAndDoesNotReturnItsTargetDuringASampledSwapRace(t *testing.T) {
-	brain, facts, _ := searchBrain(t)
-	target := inBrainTarget(t, brain)
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "..", "raw", "s.md"), filepath.Join(facts, "inlink.md")))
-	r, err := hydrate(brain, "wiki/w/facts/inlink.md")
-	assert.Error(t, err)
-	assert.NotContains(t, r.Excerpt+r.Title, brainfstest.Sentinel)
-
-	p := filepath.Join(facts, "r.md")
-	require.NoError(t, os.WriteFile(p, []byte("# r\n\nzqinside"), 0o644))
-	r, err = hydrate(brain, "wiki/w/facts/r.md")
-	require.NoError(t, err)
-	assert.Contains(t, r.Excerpt, "zqinside", "positive control: a regular note hydrates")
-	brainfstest.AssertNoLeakFrom(t, p, "# r\n\nzqinside", target, 1500*time.Millisecond, func() string {
-		r, _ := hydrate(brain, "wiki/w/facts/r.md")
-		return r.Title + r.Excerpt
-	})
-}
@@ -1,29 +0,0 @@
-package search
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-// Only the leading frontmatter is provenance; a body line that looks like a
-// key is prose (the doc comment's claim, now observed).
-func TestExtractProvenanceIgnoresBodyLines(t *testing.T) {
-	o, w := extractProvenance("---\ntitle: t\n---\norigin: static\nwritten_by: local-cli\n")
-	assert.Equal(t, "", o)
-	assert.Equal(t, "", w)
-	o, w = extractProvenance("# no frontmatter\norigin: static\n")
-	assert.Equal(t, "", o)
-	assert.Equal(t, "", w)
-	o, w = extractProvenance("---\norigin: jwt\nwritten_by: attacker\n---\norigin: static\n")
-	assert.Equal(t, "jwt", o)
-	assert.Equal(t, "attacker", w)
-}
-
-// Round 3 (B1): an indented "---" inside a block scalar is content, not the
-// closing fence — the same rule as frontmatter.Split.
-func TestExtractProvenanceUsesTheSharedFenceRule(t *testing.T) {
-	o, w := extractProvenance("---\nk: |\n  ---\norigin: jwt\nwritten_by: attacker\n---\nbody\n")
-	assert.Equal(t, "jwt", o)
-	assert.Equal(t, "attacker", w)
-}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
mathiasandClaude Sonnet 5	442557ca31	docs(mcp): document checkClaimEnvelope's accepted v1 gap CI / Lint / Test / Vet (pull_request) Successful in 33s Details CI / Mirror to GitHub (pull_request) Skipped Details Round 7's review found an 8th bypass in the same "value hidden from the extractor" family as round 6, inside the fold logic round 7's own fix had just added (a blank line interrupting a folded continuation) — the second distinct gap found on the first alternate shape tried against that fix. Decision (Mathias, via the running sweep session): ship this PR's rounds 1-7 as v1 rather than continue incremental patches past the point of diminishing returns. Every bypass found across all 7 rounds requires the caller to already hold brain_edit write access and to deliberately construct a specific malformed-YAML shape with knowledge of this exact gap — narrow and low-likelihood next to another patch cycle. The real fix (one shared, tested, encoding-normalized frontmatter parser, replacing the three independent hand-rolled implementations this bug class keeps surfacing in) is tracked separately as hyperguild#138. Document the boundary directly on checkClaimEnvelope so the next person reading this function knows what's covered and what's a deliberate, recorded trade-off rather than an unnoticed gap. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-23 12:25:30 +02:00
mathiasandClaude Sonnet 5	42578c21b9	fix(mcp): fold YAML block-scalar continuations before validating the envelope CI / Lint / Test / Vet (pull_request) Successful in 33s Details CI / Mirror to GitHub (pull_request) Skipped Details Round-6 review found a bypass in a different mechanism than rounds 1-6's fence-detection family: frontmatterScalars's indentation guard skips any indented continuation line outright, so old_str="half_life: durable", new_str="half_life:\n garbage-value" turns the field into a YAML block-scalar shape whose real value lives on the continuation line. present()'s own "empty value = placeholder, not an assertion" contract then treats the field as absent, and claim.ValidateEnvelope never sees the invalid value at all — no encoding quirk needed, one ordinary brain_edit call smuggles an out-of-enum value straight past the check. Fold indented continuation lines into the value when a top-level key's inline value is empty, so oneOf() still sees what was actually written. A genuinely empty value (no indented line follows) still folds to "", preserving the existing placeholder-not-assertion behavior for legitimately unset fields. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-23 10:51:09 +02:00
mathiasandClaude Sonnet 5	1d67e16c0d	fix(mcp): strip a leading UTF-8 BOM before frontmatter fence detection CI / Lint / Test / Vet (pull_request) Successful in 42s Details CI / Mirror to GitHub (pull_request) Skipped Details Round-5 review found a sixth bypass, same mechanism as round 4's CRLF gap, one layer earlier: a leading UTF-8 BOM (EF BB BF) defeats strings.HasPrefix(doc, "---\n") before CRLF normalization even applies. Judged live-plausible rather than exotic — Notepad's default "UTF-8" save and PowerShell's pre-v6 Out-File/Set-Content both emit a BOM — so fixed inline at the same cost as the CRLF fix rather than deferred wholesale to hyperguild#138. Strip the BOM before the CRLF normalization in frontmatterBlock, so every caller (fence-presence detection and frontmatterScalars) agrees regardless of encoding. Drawing the line here: further encoding variants in this family (NEL line separators, UTF-16 BOM, lone-CR classic-Mac endings) are judged not live-plausible in a git-tracked UTF-8 markdown corpus and are tracked wholesale under hyperguild#138's parser consolidation rather than chased as individual rounds on this PR. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-23 10:44:54 +02:00
mathiasandClaude Sonnet 5	4f75279ceb	fix(mcp): normalize CRLF before frontmatter fence detection CI / Lint / Test / Vet (pull_request) Successful in 33s Details CI / Mirror to GitHub (pull_request) Skipped Details Round-4 review found a fifth bypass, and this one needs no adversarial old_str/new_str crafting at all: frontmatterBlock's fence detection matches the literal byte sequence "---\n". A note whose fence lines use CRLF ("---\r\n") fails strings.HasPrefix(doc, "---\n") on the precondition read purely from line-ending encoding — hadFence is false, so the round-3/round-4 checks can never fire, frontmatterScalars falls back to an empty map, and claim.ValidateEnvelope({}) is nil by design. An invalid claim_provenance value lands with zero error. Zero CRLF-fenced notes exist in the live corpus today, but nothing in the code prevented one, and this class of encoding-dependent false negative could resurface in any of the other fence-based checks. Normalize once inside frontmatterBlock so every caller (fence-presence detection and frontmatterScalars) agrees regardless of line ending. The broader structural concern — three independent, subtly inconsistent fence-parsing implementations across internal/mcp, internal/api, and internal/frontmatter, of which this CRLF gap is a direct symptom — is out of scope for this PR and filed separately as hyperguild#138. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-23 10:40:00 +02:00
mathiasandClaude Sonnet 5	110e8b8f75	fix(mcp): reject edits that strip a note's frontmatter fence CI / Lint / Test / Vet (pull_request) Successful in 34s Details CI / Mirror to GitHub (pull_request) Skipped Details Round-3 review found a fourth bypass: checkClaimEnvelope always validates frontmatterScalars(after), but an edit whose new_str drops the closing "---" degrades `after` to "unfenced" in the same call. frontmatterBlock(after) then returns ok=false, frontmatterScalars returns an empty map, and claim.ValidateEnvelope({}) is nil by design (absent fields are valid) — so an invalid enum value lands on disk with zero error, and the note is left permanently unfenced. A note that had a valid fence before the edit must still have one after, or the edit is rejected outright — closes this off structurally rather than special-casing the fence-removal shape. Also guards oldStr == "" as a no-op (strings.Replace treats "" as matching position 0, which would otherwise look like an edit that inserts text before the fence): that degenerate case belongs to notes.Edit's own "old_str is empty" refusal (#115), not to the envelope check — TestBrainEdit_EmptyOldStrErrorNamesRawArgumentBytes caught the regression when this guard was still missing. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-23 10:32:46 +02:00
mathiasandClaude Sonnet 5	0f932d8f77	fix(mcp): drop the containment gate, always validate the post-edit envelope CI / Lint / Test / Vet (pull_request) Successful in 41s Details CI / Mirror to GitHub (pull_request) Skipped Details Round-2 review found a third bypass: checkClaimEnvelope required old_str to be fully contained within the extracted frontmatter block (which excludes both "---" fence lines). An old_str disambiguated across the closing fence into the body — a natural choice, since notes.Edit requires old_str to be unique — failed that containment test, so the gate skipped validation entirely while notes.Edit applied the replace verbatim, reaching the same invalid-enum outcome as the two bypasses already closed. Remove the containment gate structurally instead of patching another edge: checkClaimEnvelope now always computes the post-edit doc and validates its resulting frontmatter, regardless of old_str's textual relationship to the fence. A body-only edit leaves the frontmatter unchanged (still valid, since the note started valid), so this is a no-op for the common case and fail-closed for every case that touches the envelope, however old_str is phrased. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-23 10:27:30 +02:00
mathiasandClaude Sonnet 5	062574dad8	fix(mcp): close claim-envelope bypass on value-only brain_edit diffs CI / Lint / Test / Vet (pull_request) Successful in 33s Details CI / Mirror to GitHub (pull_request) Skipped Details Review of PR #136 found the gate trivially bypassable: touchesClaimEnvelope only fired when old_str/new_str contained the claim-envelope FIELD NAME as a substring, but a natural value-only diff (old_str: "asserted", new_str: "guessed" against a claim_provenance line) never mentions the field name and walked straight past it — notes.Edit wrote the invalid enum value to disk with zero error. Redesign the gate to be position-based instead of name-based: checkClaimEnvelope now checks whether old_str is physically contained within the note's frontmatter block (via the new frontmatterBlock helper), previews the exact strings.Replace the real edit would perform, and validates the resulting envelope before the edit is allowed to run. frontmatterScalars now builds on the shared frontmatterBlock helper. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-23 10:21:53 +02:00
mathiasandClaude Sonnet 5	f7fe00cecf	fix(mcp): validate the claim envelope before brain_edit writes too CI / Lint / Test / Vet (pull_request) Successful in 36s Details CI / Mirror to GitHub (pull_request) Skipped Details hyperguild#123, the audit follow-up from #111: writeHallNote and UpdateNote both validate the claim envelope (half_life/applies/ claim_provenance) before writing; brain_edit didn't -- a byte-level string replace has no frontmatter awareness at all, so a caller could rewrite an existing envelope line (e.g. flip claim_provenance from asserted to guessed, or set half_life to a value outside the enum) straight past the validator. This was the one live, model-facing gap #123 identified; the ingestion pipeline write paths audited alongside it turned out not to touch these fields at all, so this closes the issue. Fixed by previewing what old_str->new_str would produce -- the exact strings.Replace(before, old_str, new_str, 1) formula notes.Edit itself uses internally -- and validating the envelope on that preview before the real edit is allowed to run. Fail-closed: an invalid result blocks the edit entirely, matching create/supersede's existing posture. Scoped to notes only (scope == notes.ScopeNotes) since governance files have no claim-envelope concept, and gated on a cheap substring check so an ordinary body edit that never mentions an envelope field name pays nothing extra. The preview doesn't replicate notes.Edit's uniqueness/CRLF/conflict- marker checks -- if old_str is absent or ambiguous, the preview may not match what Edit ultimately does, but Edit independently and correctly rejects those cases at write time regardless, so nothing about write safety rides on this preview's accuracy, only the envelope check itself. frontmatterScalars is a third, minimal implementation of the same indented-line-safe scalar extraction as the sibling packages (hyperguild#126/#128) -- deliberately not shared/exported across packages (each package's frontmatter handling has slightly different needs and none currently import each other), but built the same way from the start this time rather than needing a follow-up fix. Flip-tested: disabling the pre-check gate lets the invalid-envelope test fail (the edit silently succeeds); restoring it passes. Full module suite green. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-23 10:13:59 +02:00