Merge origin/main into fix/tunnel-traversal (conflict-only)

Conflict in ingestion/internal/brainfs/brainfs_test.go only: both sides
appended a test after TestReadRegularNeverReturnsAnInBrainFileSwappedInBehindASymlink
(this branch: TestWriteRegularRefusesFinalSymlinksFIFOsEscapesAndMissingFilesAndRewritesRegularFiles;
main: TestReadDirDirsListsOnlyRealSubdirsAndRefusesSymlinkedComponents).
Kept both, unchanged. No production code touched by the resolution.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ingestion/cmd/server/jwt_validator.go

@@ -2,25 +2,24 @@ package main
 
 import (
 	"context"
-	"fmt"
 	"log/slog"
 
 	chassisauth "git.d-ma.be/mathias/mcp-chassis/auth"
+
+	"github.com/mathiasbq/hyperguild/ingestion/internal/startupretry"
 )
 
-// buildJWTValidator builds the JWT validator for issuer (nil when issuer is
+// buildJWTValidator runs OIDC discovery under policy, so a 502 from an auth
-// empty: JWT auth disabled). Since mcp-chassis v0.7 construction no longer
+// upstream that is not serving yet on a cold boot is retried instead of
-// fails when OIDC discovery does (mcp-chassis#4): the issuer resolves lazily,
+// exiting (#83). It honours ctx between attempts.
-// and until it does a JWT is answered 503-and-retry, not 401. That replaces
+func buildJWTValidator(
-// #83's boot-time retry loop (hyperguild#155). An issuer still unresolved at
+	ctx context.Context, logger *slog.Logger, issuer, audience string, policy startupretry.Policy,
-// boot is logged, so a misconfigured issuer is visible rather than silent.
+) (*chassisauth.JWTValidator, error) {
-func buildJWTValidator(ctx context.Context, logger *slog.Logger, issuer, audience string) (*chassisauth.JWTValidator, error) {
+	return startupretry.Do(ctx, policy, func(ctx context.Context) (*chassisauth.JWTValidator, error) {
-	v, err := chassisauth.NewJWTValidator(ctx, issuer, audience)
+		v, err := chassisauth.NewJWTValidator(ctx, issuer, audience)
-	if err != nil {
+		if err != nil {
-		return nil, fmt.Errorf("build jwt validator: %w", err)
+			logger.Warn("oidc discovery not ready, retrying", "err", err)
-	}
+		}
-	if ok, rerr := v.Ready(ctx); !ok {
+		return v, err
-		logger.Warn("jwt issuer not resolved at boot; JWTs answer 503 until it is", "issuer", issuer, "err", rerr)
+	})
-	}
-	return v, nil
 }

ingestion/cmd/server/jwt_validator_test.go

@@ -1,7 +1,6 @@
 package main
 
 import (
-	"bytes"
 	"context"
 	"io"
 	"log/slog"
@@ -9,11 +8,12 @@ import (
 	"net/http/httptest"
 	"sync/atomic"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/mathiasbq/hyperguild/ingestion/internal/metrics"
+	"github.com/mathiasbq/hyperguild/ingestion/internal/startupretry"
 )
 
 // fakeIssuer answers OIDC discovery with 502 for the first fail requests, as
@@ -41,71 +41,46 @@ func fakeIssuer(t *testing.T, fail int32) (*httptest.Server, *atomic.Int32) {
 	return srv, &discoveries
 }
 
-// #83 retried discovery at boot because chassis v0.2.0 failed construction on
+var fastPolicy = startupretry.Policy{Attempts: 8, Base: time.Millisecond, Max: 5 * time.Millisecond}
-// a 502. Since chassis v0.7 (mcp-chassis#4) the validator is built anyway and
+
-// resolves the issuer lazily, so boot no longer waits or exits on it
+func TestBuildJWTValidatorRetriesDiscovery502sThenSucceeds(t *testing.T) {
-// (hyperguild#155). An unresolved issuer is logged at boot.
+	srv, discoveries := fakeIssuer(t, 3)
-func TestBuildJWTValidatorReturnsAValidatorWhileDiscovery502s(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
-	srv, _ := fakeIssuer(t, 1000)
+	defer cancel()
-	var buf bytes.Buffer
+
-	v, err := buildJWTValidator(context.Background(), slog.New(slog.NewTextHandler(&buf, nil)), srv.URL, "brain")
+	v, err := buildJWTValidator(ctx, slog.New(slog.DiscardHandler), srv.URL, "brain", fastPolicy)
 	require.NoError(t, err)
 	assert.NotNil(t, v)
-	assert.Contains(t, buf.String(), "jwt issuer not resolved at boot")
+	assert.Equal(t, int32(4), discoveries.Load(), "three 502s, then the successful discovery")
 }
 
-func TestBuildJWTValidatorLogsNothingAgainstAHealthyIssuer(t *testing.T) {
+func TestBuildJWTValidatorGivesUpAfterTheBudgetWithTheLastError(t *testing.T) {
-	srv, _ := fakeIssuer(t, 0)
+	srv, discoveries := fakeIssuer(t, 1000)
-	var buf bytes.Buffer
+	ctx, cancel := context.WithCancel(context.Background())
-	v, err := buildJWTValidator(context.Background(), slog.New(slog.NewTextHandler(&buf, nil)), srv.URL, "brain")
+	defer cancel()
-	require.NoError(t, err)
+
-	assert.NotNil(t, v)
+	_, err := buildJWTValidator(ctx, slog.New(slog.DiscardHandler), srv.URL, "brain", fastPolicy)
-	assert.NotContains(t, buf.String(), "not resolved")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "status 502")
+	assert.Equal(t, int32(8), discoveries.Load(), "bounded: exactly the attempt budget")
 }
 
-func TestBuildJWTValidatorIsNilWithoutAnIssuer(t *testing.T) {
+func TestBuildJWTValidatorStopsRetryingWhenTheContextIsCancelled(t *testing.T) {
-	v, err := buildJWTValidator(context.Background(), slog.New(slog.DiscardHandler), "", "brain")
-	require.NoError(t, err)
-	assert.Nil(t, v)
-}
-
-// With the issuer unresolved, a JWT on a REST route answers 503 (retry), not
-// 401: the token may be fine, the server just cannot check it yet.
-func TestBuildMuxAnswers503ToAJWTWhileTheIssuerIsUnresolved(t *testing.T) {
 	srv, _ := fakeIssuer(t, 1000)
-	v, err := buildJWTValidator(context.Background(), slog.New(slog.DiscardHandler), srv.URL, "brain")
+	ctx, cancel := context.WithCancel(context.Background())
-	require.NoError(t, err)
+	slow := startupretry.Policy{Attempts: 8, Base: time.Hour, Max: time.Hour}
-	mux, err := buildMux(restAuth{token: routesTok, validator: v, realm: "brain"}, testHandler(t),
-		okHandler("mcp"), metrics.New(), nil)
-	require.NoError(t, err)
-	code, _ := do(t, mux, "GET", "/pending", "Bearer aaa.bbb.ccc")
-	assert.Equal(t, http.StatusServiceUnavailable, code)
-}
 
-// PR #183 review: /mcp shares REST's bearer, but only the static token was
+	done := make(chan error, 1)
-// asserted on it. With the issuer unresolved, a JWT on /mcp answers 503 too,
+	go func() {
-// so /mcp's middleware was built with the JWT validator.
+		_, err := buildJWTValidator(ctx, slog.New(slog.DiscardHandler), srv.URL, "brain", slow)
-func TestBuildMuxAnswers503ToAJWTOnMCPWhileTheIssuerIsUnresolved(t *testing.T) {
+		done <- err
-	srv, _ := fakeIssuer(t, 1000)
+	}()
-	v, err := buildJWTValidator(context.Background(), slog.New(slog.DiscardHandler), srv.URL, "brain")
+	time.Sleep(50 * time.Millisecond)
-	require.NoError(t, err)
+	cancel()
-	mux, err := buildMux(restAuth{token: routesTok, validator: v, realm: "brain"}, testHandler(t),
+	select {
-		okHandler("mcp"), metrics.New(), nil)
+	case err := <-done:
-	require.NoError(t, err)
+		assert.ErrorIs(t, err, context.Canceled)
-	code, _ := do(t, mux, "POST", "/mcp", "Bearer aaa.bbb.ccc")
+	case <-time.After(3 * time.Second):
-	assert.Equal(t, http.StatusServiceUnavailable, code)
+		t.Fatal("did not return after the context was cancelled")
-}
+	}
-
-// PR #183 review: a 401 on /mcp names the protected-resource metadata in
-// WWW-Authenticate (what the claude.ai OAuth connector discovers from), so
-// /mcp's middleware was built with resourceMetadataURL.
-func TestBuildMuxMCP401CarriesResourceMetadataInWWWAuthenticate(t *testing.T) {
-	const rm = "https://brain.example/.well-known/oauth-protected-resource"
-	mux, err := buildMux(restAuth{token: routesTok, realm: "brain", resourceMetadataURL: rm}, testHandler(t),
-		okHandler("mcp"), metrics.New(), nil)
-	require.NoError(t, err)
-	rec := httptest.NewRecorder()
-	mux.ServeHTTP(rec, httptest.NewRequest(http.MethodPost, "/mcp", nil))
-	require.Equal(t, http.StatusUnauthorized, rec.Code)
-	assert.Contains(t, rec.Header().Get("WWW-Authenticate"), `resource_metadata="`+rm+`"`)
 }

ingestion/cmd/server/main.go

@@ -32,6 +32,7 @@ import (
 	"github.com/mathiasbq/hyperguild/ingestion/internal/pipeline"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/reranker"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/search"
+	"github.com/mathiasbq/hyperguild/ingestion/internal/startupretry"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/symlinkguard"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/vectorstore"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/watcher"
@@ -368,15 +369,21 @@ func main() {
 	// hyperguild#157: report a symlink that appears in the brain while running.
 	go symlinkguard.Watch(ctx, brainDir, symlinkScanInterval(os.Getenv), buildNotifier())
 
-	// Never fatal on an unreachable issuer (#83): on a cold cluster boot this
+	// Built before the watcher, the graph backfill and session ingestion, and
-	// pod can beat dex to serving and get a 502 from ingress, and exiting meant
+	// retried rather than fatal (#83). Two separate reasons:
-	// CrashLoopBackOff redoing the backfill. Since mcp-chassis v0.7 the
+	//
-	// validator resolves the issuer lazily and answers JWTs 503-and-retry until
+	//   - On a cold cluster boot this pod can beat dex to serving and gets a
-	// it does (hyperguild#155), so no boot retry is needed. A misconfigured
+	//     502 from ingress. Nothing is misconfigured; it simply started first.
-	// issuer no longer exits the process: it is logged at boot and every JWT
+	//     Exiting there meant CrashLoopBackOff redoing the backfill on every
-	// gets 503; the static bearer keeps working.
+	//     attempt, with exponential backoff stretching the brain outage.
+	//   - Constructing it first means a genuine config error (wrong issuer,
+	//     bad audience) fails in seconds instead of after all that work.
+	//
+	// The budget stays bounded: retrying forever would turn a misconfiguration
+	// into a process that looks alive and never serves.
 	jwtValidator, err := buildJWTValidator(ctx, logger,
-		os.Getenv("DEX_ISSUER_URL"), os.Getenv("MCP_AUDIENCE"))
+		os.Getenv("DEX_ISSUER_URL"), os.Getenv("MCP_AUDIENCE"),
+		startupretry.Policy{Attempts: 8, Base: time.Second, Max: 30 * time.Second})
 	if err != nil {
 		logger.Error("build jwt validator", "err", err)
 		os.Exit(1)
@@ -516,6 +523,8 @@ func main() {
 		}
 	}
 
+	public["/mcp"] = chassisauth.BearerMiddleware(mcpToken, jwtValidator, "brain", resourceMetadataURL, mcpSrv)
+
 	// POST /capture (#53/#54): the uniform capture REST door. Needs a ticket
 	// tracker to file action items, so it only mounts when Gitea is
 	// configured. It reuses the MCP server's graph-wired brain store (one
@@ -539,7 +548,7 @@ func main() {
 		public["POST /capture"] = captureH
 		// Same use-case behind the MCP `capture` tool (#55 relay) so MCP-native
 		// harnesses (claude.ai, Crush, Pi, LLM Council) reach capture through
-		// the existing /mcp OAuth connector. buildMux wraps this same mcpSrv;
+		// the existing /mcp OAuth connector. mcpSrv is already wrapped above;
 		// WithCapture mutates the same instance, so the tool appears live.
 		mcpSrv.WithCapture(captureSvc, jwtValidator, mcpToken, "local-cli", resolver)
 		// hyperguild#97: a governance-file rewrite gets the same trail a
@@ -581,18 +590,19 @@ func main() {
 		os.Exit(1)
 	}
 
-	// /metrics — unauthenticated Prometheus endpoint, scraped via the
+	// /metrics — unauthenticated Prometheus endpoint. kube-prometheus-stack
-	// ServiceMonitor in k3s/apps/supervisor/. buildMux registers it and wraps
+	// scrapes it via the ServiceMonitor in k3s/apps/supervisor/. The metrics
-	// the whole router in the registry's middleware.
+	// middleware below wraps every other registered handler so it observes
-	//
+	// real request latency. /metrics itself is excluded from its own
-	// The whole router, /mcp's bearer included, is built in buildMux so its
+	// observation by registering it on the outer mux (post-wrap).
-	// tests are tests of production wiring (PR #152 review, hyperguild#154).
+	reg := metrics.New()
-	// The REST API's credential is the same as /mcp's. Untested here: the
+	public["GET /metrics"] = http.HandlerFunc(reg.Handler())
-	// restAuth fields and the public map this call passes in (e.g. a nil
+
-	// validator would drop JWT auth on /mcp and REST and the suite stays
+	// The whole router, built in one place so the test of buildMux is a test
-	// green), and ListenAndServe serving the result unchanged (hyperguild#182).
+	// of production wiring (PR #152 review). The REST API's credential is the
-	handler, err := buildMux(restAuth{token: mcpToken, validator: jwtValidator, realm: "brain",
+	// same as /mcp's.
-		resourceMetadataURL: resourceMetadataURL}, h, mcpSrv, metrics.New(), public)
+	mux, err := buildMux(restAuth{token: mcpToken, validator: jwtValidator, realm: "brain",
+		resourceMetadataURL: resourceMetadataURL}, h, public)
 	if err != nil {
 		logger.Error("build router", "err", err)
 		os.Exit(1)
@@ -613,7 +623,7 @@ func main() {
 		"watch_interval", watchIntervalLog,
 		"mcp_enabled", true,
 	)
-	if err := http.ListenAndServe(addr, handler); err != nil {
+	if err := http.ListenAndServe(addr, reg.Middleware(mux)); err != nil {
 		logger.Error("server stopped", "err", err)
 		os.Exit(1)
 	}

ingestion/cmd/server/routes.go

@@ -8,22 +8,22 @@ import (
 	chassisauth "git.d-ma.be/mathias/mcp-chassis/auth"
 
 	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/metrics"
 )
 
-// publicRoutes is the complete set of patterns a caller may register on the
+// publicRoutes is the complete set of patterns allowed on the outer mux,
-// outer mux, outside the REST API's auth (hyperguild#149). Each authenticates
+// outside the REST API's auth (hyperguild#149). Each authenticates itself or is
-// itself or is meant to be open: /capture (bearer/JWT), the webhook (HMAC),
+// meant to be open: /mcp (bearer/JWT), /capture (bearer/JWT), the webhook
-// /oauth/token (client secret) and OAuth metadata (open). /mcp and /metrics
+// (HMAC), /oauth/token (client secret), OAuth metadata and /metrics (open).
-// are not here: buildMux builds them itself (hyperguild#154). A REST pattern
+// A REST pattern added here would beat the authenticated catch-all by
-// added here would beat the authenticated catch-all by specificity and ship
+// specificity and ship open, which is why buildMux refuses anything else.
-// open, which is why buildMux refuses anything else.
 var publicRoutes = map[string]bool{
+	"/mcp":                      true,
 	"POST /capture":             true,
 	"POST /webhooks/brain-sync": true,
 	"GET /.well-known/oauth-protected-resource":   true,
 	"GET /.well-known/oauth-authorization-server": true,
 	"POST /oauth/token":                           true,
+	"GET /metrics":                                true,
 }
 
 // restAuth is the credential the REST API checks: the same as /mcp's.
@@ -34,25 +34,16 @@ type restAuth struct {
 	resourceMetadataURL string
 }
 
-// buildMux builds the handler main passes to ListenAndServe unchanged. The
+// buildMux is the server's whole router. The REST API is mounted at "/"
-// REST API is mounted at "/" and /mcp is registered, both behind bearer auth
+// behind bearer auth that buildMux constructs itself, so a caller cannot pass
-// that buildMux constructs itself from auth (one credential), so a caller
+// a no-op; public handlers are registered as given, and only for patterns on
-// cannot pass a no-op. GET /metrics serves reg, and the whole router is
+// the publicRoutes allowlist. It returns an http.Handler, not the
-// wrapped in reg's middleware. Other public handlers are registered as given,
+// *ServeMux, so nothing can register a route on the result afterwards and
-// and only for patterns on the publicRoutes allowlist. It returns an
+// bypass the allowlist.
-// http.Handler, not the *ServeMux, so nothing can register a route on the
+func buildMux(auth restAuth, h *api.Handler, public map[string]http.Handler) (http.Handler, error) {
-// result. What stays untested is main's call site: the restAuth fields and
-// the public map main passes in, and ListenAndServe serving this handler
-// unchanged (hyperguild#182). The tests build their own arguments.
-func buildMux(
-	auth restAuth, h *api.Handler, mcpHandler http.Handler, reg *metrics.Registry, public map[string]http.Handler,
-) (http.Handler, error) {
 	if auth.token == "" {
 		return nil, errors.New("buildMux: REST auth needs a token")
 	}
-	if mcpHandler == nil || reg == nil {
-		return nil, errors.New("buildMux: needs the MCP handler and the metrics registry")
-	}
 	mux := http.NewServeMux()
 	for pattern, handler := range public {
 		if !publicRoutes[pattern] {
@@ -60,15 +51,10 @@ func buildMux(
 		}
 		mux.Handle(pattern, handler)
 	}
-	bearer := func(next http.Handler) http.Handler {
+	mountREST(mux, h, func(next http.Handler) http.Handler {
 		return chassisauth.BearerMiddleware(auth.token, auth.validator, auth.realm, auth.resourceMetadataURL, next)
-	}
+	})
-	mux.Handle("/mcp", bearer(mcpHandler))
+	return mux, nil
-	// /metrics is registered on the mux and so observed by its own
-	// middleware, like any route.
-	mux.Handle("GET /metrics", reg.Handler())
-	mountREST(mux, h, bearer)
-	return reg.Middleware(mux), nil
 }
 
 // mountREST registers the REST API on its own mux and mounts it at "/" behind
@@ -87,23 +73,5 @@ func mountREST(mux *http.ServeMux, h *api.Handler, auth func(http.Handler) http.
 	rest.HandleFunc("POST /promote", h.Promote)
 	rest.HandleFunc("POST /backfill-embeddings", h.BackfillEmbeddings)
 	rest.HandleFunc("GET /pass-rate", h.PassRate)
-	mux.Handle("/", labelRESTPattern(rest, auth(rest)))
+	mux.Handle("/", auth(rest))
-}
-
-// labelRESTPattern sets the request's Pattern to the REST route it addresses
-// before auth runs, so the metrics middleware (which reads Pattern from the
-// same *http.Request) labels a refused request by its route rather than by
-// the "/" mount (hyperguild#155). A refused request to a path no route
-// matches keeps "/", so for refused requests the label set stays bounded by
-// the registered routes. That bound does not hold for authenticated
-// requests: an unregistered path reaches the REST mux, which 404s with an
-// empty Pattern, and the metrics middleware falls back to the raw URL path
-// (hyperguild#185).
-func labelRESTPattern(rest *http.ServeMux, next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if _, pattern := rest.Handler(r); pattern != "" {
-			r.Pattern = pattern
-		}
-		next.ServeHTTP(w, r)
-	})
 }

ingestion/cmd/server/routes_observability_test.go

@@ -1,88 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"log/slog"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// wrongTokSentinel is a presented credential distinctive enough that any
-// occurrence in a log line is the raw token, not a coincidence.
-const wrongTokSentinel = "wrong-tok-sentinel-q7zx"
-
-// hyperguild#155: since #149 every REST route sits behind BearerMiddleware,
-// and chassis v0.2.0 refused without logging, so an unknown caller got
-// silent 401s. The chassis now writes an `mcp auth rejected` line, and the
-// presented token appears nowhere in the log as a bare value (PR #181
-// review: asserting on the "Bearer " header form could never fail, since
-// the chassis logs fields, not headers).
-func TestBuildMuxRejectionLogLineOmitsTheBarePresentedToken(t *testing.T) {
-	var buf bytes.Buffer
-	prev := slog.Default()
-	slog.SetDefault(slog.New(slog.NewTextHandler(&buf, nil)))
-	t.Cleanup(func() { slog.SetDefault(prev) })
-
-	code, _ := do(t, testMux(t), "POST", "/query", "Bearer "+wrongTokSentinel)
-	require.Equal(t, http.StatusUnauthorized, code)
-	assert.Contains(t, buf.String(), "mcp auth rejected")
-	assert.Contains(t, buf.String(), "path=/query")
-	assert.NotContains(t, buf.String(), wrongTokSentinel, "the rejected token is logged as a bare value")
-	assert.NotContains(t, buf.String(), routesTok, "the valid static token is logged")
-}
-
-// The `mcp auth accepted` line leaves out the valid static token.
-func TestBuildMuxAcceptedLogLineOmitsTheBareStaticToken(t *testing.T) {
-	var buf bytes.Buffer
-	prev := slog.Default()
-	slog.SetDefault(slog.New(slog.NewTextHandler(&buf, nil)))
-	t.Cleanup(func() { slog.SetDefault(prev) })
-
-	code, _ := do(t, testMux(t), "GET", "/pending", "Bearer "+routesTok)
-	require.Equal(t, http.StatusOK, code)
-	assert.Contains(t, buf.String(), "mcp auth accepted")
-	assert.NotContains(t, buf.String(), routesTok, "the accepted static token is logged as a bare value")
-}
-
-// An authenticated REST request is labelled with the REST mux's pattern:
-// the inner mux sets it on the same *http.Request the outer middleware reads.
-func TestMetricsLabelAnAuthenticatedRESTRequestWithItsRoutePattern(t *testing.T) {
-	mux, reg := testMuxAndRegistry(t)
-	code, _ := do(t, mux, "GET", "/pending", "Bearer "+routesTok)
-	require.Equal(t, http.StatusOK, code)
-
-	rec := httptest.NewRecorder()
-	reg.Handler().ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/metrics", nil))
-	assert.Contains(t, rec.Body.String(), `path="GET /pending"`)
-	assert.NotContains(t, rec.Body.String(), `path="/"`)
-}
-
-// hyperguild#155: a request refused by REST auth never reaches the REST mux,
-// so it was labelled path="/" and a 4xx on /query could not be told from one
-// on /write. It is now labelled with the REST pattern it was addressed to.
-func TestMetricsLabelARejectedRESTRequestWithItsRoutePattern(t *testing.T) {
-	mux, reg := testMuxAndRegistry(t)
-	code, _ := do(t, mux, "POST", "/query", "")
-	require.Equal(t, http.StatusUnauthorized, code)
-
-	rec := httptest.NewRecorder()
-	reg.Handler().ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/metrics", nil))
-	assert.Contains(t, rec.Body.String(), `path="POST /query",status="4xx"`)
-}
-
-// A path no REST route matches keeps the catch-all label, so an attacker
-// probing random URLs cannot grow the series set.
-func TestMetricsLabelARejectedUnknownPathWithTheCatchAll(t *testing.T) {
-	mux, reg := testMuxAndRegistry(t)
-	code, _ := do(t, mux, "POST", "/no-such-route-zq", "")
-	require.Equal(t, http.StatusUnauthorized, code)
-
-	rec := httptest.NewRecorder()
-	reg.Handler().ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/metrics", nil))
-	assert.Contains(t, rec.Body.String(), `path="/",status="4xx"`)
-	assert.NotContains(t, rec.Body.String(), "no-such-route-zq")
-}

ingestion/cmd/server/routes_test.go

@@ -12,7 +12,6 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/metrics"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/pipeline"
 )
 
@@ -22,34 +21,20 @@ func okHandler(body string) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { _, _ = w.Write([]byte(body)) })
 }
 
-// testMux builds the router through buildMux, the function main calls, with
+// testMux builds the router exactly as main does: buildMux with the full
-// every allowlisted public pattern (stub handlers), a stub MCP server and a
+// public set main registers (stub handlers) and real bearer config.
-// static token only: no JWT validator and no resourceMetadataURL (the tests
+// hyperguild#149: the REST API is authenticated as a whole; the PR #152
-// in jwt_validator_test.go pass those). It does not use main's own restAuth
+// review showed a test of a COPY of the router let main.go regress unseen.
-// or public map (hyperguild#182). hyperguild#149: the REST API is
-// authenticated as a whole; the PR #152 review showed a test of a COPY of
-// the router let main.go regress unseen.
 func testMux(t *testing.T) http.Handler {
 	t.Helper()
-	mux, _ := testMuxAndRegistry(t)
+	h := api.NewHandler(t.TempDir(), slog.New(slog.NewTextHandler(os.Stderr, nil)), pipeline.Config{})
-	return mux
-}
-
-func testMuxAndRegistry(t *testing.T) (http.Handler, *metrics.Registry) {
-	t.Helper()
 	public := map[string]http.Handler{}
 	for p := range publicRoutes {
 		public[p] = okHandler("public " + p)
 	}
-	reg := metrics.New()
+	mux, err := buildMux(restAuth{token: routesTok, realm: "brain"}, h, public)
-	mux, err := buildMux(restAuth{token: routesTok, realm: "brain"}, testHandler(t), okHandler("mcp"), reg, public)
 	require.NoError(t, err)
-	return mux, reg
+	return mux
-}
-
-func testHandler(t *testing.T) *api.Handler {
-	t.Helper()
-	return api.NewHandler(t.TempDir(), slog.New(slog.NewTextHandler(os.Stderr, nil)), pipeline.Config{})
 }
 
 func do(t *testing.T, h http.Handler, method, path, authz string) (int, string) {
@@ -89,9 +74,8 @@ func TestBuildMuxAuthenticatesAnUnregisteredPath(t *testing.T) {
 }
 
 // buildMux registers public handlers as given, without adding auth: each
-// public route owns its own (bearer/JWT on /capture, HMAC on the webhook,
+// public route owns its own (bearer on /mcp, HMAC on the webhook, client
-// client secret on /oauth/token) or is meant to be open (OAuth metadata).
+// secret on /oauth/token) or is meant to be open (/metrics, OAuth metadata).
-// /mcp and /metrics are not public routes: buildMux builds them itself.
 func TestBuildMuxDoesNotWrapPublicRoutes(t *testing.T) {
 	r := testMux(t)
 	for p := range publicRoutes {
@@ -109,53 +93,14 @@ func TestBuildMuxDoesNotWrapPublicRoutes(t *testing.T) {
 // over the authenticated catch-all (more specific pattern), so it is refused.
 func TestBuildMuxRefusesAPublicPatternOffTheAllowlist(t *testing.T) {
 	h := api.NewHandler(t.TempDir(), slog.New(slog.NewTextHandler(os.Stderr, nil)), pipeline.Config{})
-	// "/mcp" and "GET /metrics" are built by buildMux itself (hyperguild#154):
+	for _, p := range []string{"POST /query", "GET /pending", "/", "POST /metrics"} {
-	// passing either as public would register them unauthenticated or twice.
+		_, err := buildMux(restAuth{token: routesTok, realm: "brain"}, h, map[string]http.Handler{p: okHandler("x")})
-	for _, p := range []string{"POST /query", "GET /pending", "/", "POST /metrics", "/mcp", "GET /metrics"} {
-		_, err := buildMux(restAuth{token: routesTok, realm: "brain"}, h, okHandler("mcp"), metrics.New(),
-			map[string]http.Handler{p: okHandler("x")})
 		assert.Error(t, err, "public pattern %q must be refused", p)
 	}
 }
 
 func TestBuildMuxRefusesAnEmptyToken(t *testing.T) {
 	h := api.NewHandler(t.TempDir(), slog.New(slog.NewTextHandler(os.Stderr, nil)), pipeline.Config{})
-	_, err := buildMux(restAuth{token: "", realm: "brain"}, h, okHandler("mcp"), metrics.New(), nil)
+	_, err := buildMux(restAuth{token: "", realm: "brain"}, h, nil)
 	assert.Error(t, err)
 }
-
-// hyperguild#154: /mcp's bearer was built in main.go, untested; the buildMux
-// tests used stubs. buildMux now wraps the MCP handler itself, with the same
-// credential as the REST API.
-func TestBuildMuxRefusesMCPWithoutAValidToken(t *testing.T) {
-	r := testMux(t)
-	for _, authz := range []string{"", "Bearer wrong"} {
-		code, body := do(t, r, "POST", "/mcp", authz)
-		assert.Equal(t, http.StatusUnauthorized, code, "authz %q", authz)
-		assert.NotEqual(t, "mcp", body)
-	}
-	code, body := do(t, r, "POST", "/mcp", "Bearer "+routesTok)
-	assert.Equal(t, http.StatusOK, code)
-	assert.Equal(t, "mcp", body)
-}
-
-func TestBuildMuxRefusesANilMCPHandlerOrRegistry(t *testing.T) {
-	auth := restAuth{token: routesTok, realm: "brain"}
-	_, err := buildMux(auth, testHandler(t), nil, metrics.New(), nil)
-	assert.Error(t, err)
-	_, err = buildMux(auth, testHandler(t), okHandler("mcp"), nil, nil)
-	assert.Error(t, err)
-}
-
-// hyperguild#154: main wrapped buildMux's result in the metrics middleware
-// before ListenAndServe, untested. buildMux now returns the handler main
-// serves as-is, metrics included: a request through it is observed and
-// exposed on its own GET /metrics.
-func TestBuildMuxObservesRequestsAndServesMetrics(t *testing.T) {
-	r := testMux(t)
-	code, _ := do(t, r, "GET", "/pending", "Bearer "+routesTok)
-	require.Equal(t, http.StatusOK, code)
-	code, body := do(t, r, "GET", "/metrics", "")
-	require.Equal(t, http.StatusOK, code)
-	assert.Contains(t, body, `path="GET /pending"`)
-}

ingestion/go.mod

@@ -51,7 +51,7 @@ require (
 )
 
 require (
-	git.d-ma.be/mathias/mcp-chassis v0.7.1
+	git.d-ma.be/mathias/mcp-chassis v0.2.0
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
 	github.com/goccy/go-json v0.10.3 // indirect

ingestion/go.sum

@@ -1,5 +1,5 @@
-git.d-ma.be/mathias/mcp-chassis v0.7.1 h1:4h8TOBHTA0L/no4IPcr4tLcQtmKUlhE2/cXyPdNFGmM=
+git.d-ma.be/mathias/mcp-chassis v0.2.0 h1:6fLmb7xqRa2nNVWsHaUbbfbArgDXJw/gDhb09clBIjo=
-git.d-ma.be/mathias/mcp-chassis v0.7.1/go.mod h1:Ks7EK2UnGAN0H3rJjKUxUagX8/ZBdtLrOlcUbv0RwH8=
+git.d-ma.be/mathias/mcp-chassis v0.2.0/go.mod h1:Ks7EK2UnGAN0H3rJjKUxUagX8/ZBdtLrOlcUbv0RwH8=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

ingestion/internal/classification/classification.go

@@ -16,10 +16,9 @@
 package classification
 
 import (
-	"errors"
 	"fmt"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
+	"os"
-	"io/fs"
+	"path/filepath"
 	"strings"
 
 	"gopkg.in/yaml.v3"
@@ -111,20 +110,9 @@ type rawConfig struct {
 func Load(brainDir string) (*Config, error) {
 	cfg := &Config{wings: map[string]Level{}, repos: map[string]Level{}}
 
-	// Read through the brain root, regular files only (hyperguild#157): a
+	data, err := os.ReadFile(filepath.Join(brainDir, "classification.yaml"))
-	// symlinked or special file is not trusted as the config, which is a hard
-	// error like a malformed one.
-	bfs, err := brainfs.Open(brainDir)
-	if errors.Is(err, fs.ErrNotExist) {
-		return cfg, nil
-	}
 	if err != nil {
-		return nil, fmt.Errorf("open brain: %w", err)
+		if os.IsNotExist(err) {
-	}
-	defer func() { _ = bfs.Close() }()
-	data, err := bfs.ReadRegular("classification.yaml")
-	if err != nil {
-		if errors.Is(err, fs.ErrNotExist) {
 			return cfg, nil
 		}
 		return nil, fmt.Errorf("read classification.yaml: %w", err)

ingestion/internal/classification/root_test.go

@@ -1,46 +0,0 @@
-package classification
-
-import (
-	"os"
-	"path/filepath"
-	"syscall"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// hyperguild#157 slice 6: Load read classification.yaml with os.ReadFile. It
-// sets the I1 sovereignty levels; a symlinked file must not be trusted as the
-// config (a hard error, as for a malformed file), and a FIFO must not hang
-// startup.
-func TestLoadRefusesASymlinkedOrFIFOClassificationFile(t *testing.T) {
-	ok := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(ok, "classification.yaml"), []byte("wings:\n  w: confidential\n"), 0o644))
-	_, err := Load(ok)
-	require.NoError(t, err, "positive control")
-
-	linked := t.TempDir()
-	require.NoError(t, os.WriteFile(filepath.Join(linked, "real.yaml"), []byte("wings:\n  w: public\n"), 0o644))
-	require.NoError(t, os.Symlink("real.yaml", filepath.Join(linked, "classification.yaml")))
-	_, err = Load(linked)
-	assert.Error(t, err, "an in-brain symlink is not trusted as the config")
-
-	fifo := t.TempDir()
-	require.NoError(t, syscall.Mkfifo(filepath.Join(fifo, "classification.yaml"), 0o644))
-	w, err := os.OpenFile(filepath.Join(fifo, "classification.yaml"), os.O_RDWR, 0)
-	require.NoError(t, err)
-	defer func() { _ = w.Close() }()
-	done := make(chan error, 1)
-	go func() { _, err := Load(fifo); done <- err }()
-	select {
-	case err := <-done:
-		assert.Error(t, err)
-	case <-time.After(3 * time.Second):
-		t.Fatal("Load hung on a FIFO")
-	}
-
-	_, err = Load(t.TempDir())
-	assert.NoError(t, err, "an absent file is still not an error")
-}

ingestion/internal/pipeline/backfill.go

@@ -3,10 +3,7 @@ package pipeline
 
 import (
 	"context"
-	"errors"
 	"fmt"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
-	"io/fs"
 	"os"
 	"path/filepath"
 	"strings"
@@ -26,16 +23,10 @@ func BackfillRefs(ctx context.Context, brainDir string) (int, error) {
 		return 0, fmt.Errorf("load inventory: %w", err)
 	}
 
-	// Listed and read through the brain root, regular files only
+	sourcesDir := filepath.Join(brainDir, "wiki", "sources")
-	// (hyperguild#157).
+	entries, err := os.ReadDir(sourcesDir)
-	bfs, err := brainfs.Open(brainDir)
 	if err != nil {
-		return 0, fmt.Errorf("open brain: %w", err)
+		if os.IsNotExist(err) {
-	}
-	defer func() { _ = bfs.Close() }()
-	names, err := bfs.ReadDirRegular("wiki/sources")
-	if err != nil {
-		if errors.Is(err, fs.ErrNotExist) {
 			return 0, nil
 		}
 		return 0, fmt.Errorf("read sources dir: %w", err)
@@ -46,20 +37,20 @@ func BackfillRefs(ctx context.Context, brainDir string) (int, error) {
 	// get both refs merged before a single write.
 	pending := make(map[string]wiki.Page)
 
-	for _, name := range names {
+	for _, e := range entries {
 		if ctx.Err() != nil {
 			return 0, ctx.Err()
 		}
-		if !strings.HasSuffix(name, ".md") {
+		if e.IsDir() || !strings.HasSuffix(e.Name(), ".md") {
 			continue
 		}
 
-		b, err := bfs.ReadRegular("wiki/sources/" + name)
+		b, err := os.ReadFile(filepath.Join(sourcesDir, e.Name()))
 		if err != nil {
 			continue
 		}
 		sourceContent := string(b)
-		sourceSlug := strings.TrimSuffix(name, ".md")
+		sourceSlug := strings.TrimSuffix(e.Name(), ".md")
 		sourceTitle := extractTitle(sourceContent)
 		if sourceTitle == "" {
 			sourceTitle = sourceSlug
@@ -79,7 +70,7 @@ func BackfillRefs(ctx context.Context, brainDir string) (int, error) {
 			// Start from already-accumulated version if we've seen this page.
 			page, seen := pending[relPath]
 			if !seen {
-				raw, err := bfs.ReadRegular(relPath)
+				raw, err := os.ReadFile(filepath.Join(brainDir, filepath.FromSlash(relPath)))
 				if err != nil {
 					continue
 				}

ingestion/internal/pipeline/pipeline.go

@@ -5,10 +5,7 @@ import (
 	"context"
 	"crypto/sha256"
 	"encoding/hex"
-	"errors"
 	"fmt"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
-	"io/fs"
 	"os"
 	"path/filepath"
 	"strings"
@@ -132,7 +129,7 @@ func buildAndWrite(ctx context.Context, rawPages []RawPage, sourceSlug, date, br
 			if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
 				return Result{}, fmt.Errorf("mkdir for %s: %w", page.Path, err)
 			}
-			content, conflicts, err := reviseOrCreate(brainDir, page)
+			content, conflicts, err := reviseOrCreate(dest, page)
 			if err != nil {
 				return Result{}, err
 			}
@@ -191,27 +188,14 @@ func hashBody(content string) string {
 
 // readSourcePage returns the full on-disk content of the source page at
 // wiki/sources/<sourceSlug>.md, or "" when it doesn't exist yet.
-// It reads through the brain root, regular files only (hyperguild#157): the
-// content goes into the LLM prompt.
 func readSourcePage(brainDir, sourceSlug string) string {
-	raw, err := readBrainFile(brainDir, "wiki/sources/"+sourceSlug+".md")
+	raw, err := os.ReadFile(filepath.Join(brainDir, "wiki", "sources", sourceSlug+".md"))
 	if err != nil {
 		return ""
 	}
 	return string(raw)
 }
 
-// readBrainFile reads one brain-relative file through the brain root,
-// regular files only (hyperguild#157).
-func readBrainFile(brainDir, rel string) ([]byte, error) {
-	bfs, err := brainfs.Open(brainDir)
-	if err != nil {
-		return nil, err
-	}
-	defer func() { _ = bfs.Close() }()
-	return bfs.ReadRegular(rel)
-}
-
 // storedSourceHash reads source_hash from the source page a previous ingest
 // wrote, or "" when there is no such page or no such field.
 //
@@ -246,10 +230,10 @@ func storedSourceHash(brainDir, sourceSlug string) string {
 // its first-ingest date on a revised page. Left deliberately — the alternative
 // is this function editing frontmatter it does not own, and no lint reads that
 // field today.
-func reviseOrCreate(brainDir string, page wiki.Page) (string, []string, error) {
+func reviseOrCreate(dest string, page wiki.Page) (string, []string, error) {
-	existing, err := readBrainFile(brainDir, page.Path)
+	existing, err := os.ReadFile(dest)
 	switch {
-	case errors.Is(err, fs.ErrNotExist):
+	case os.IsNotExist(err):
 		return page.Content, nil, nil
 	case err != nil:
 		return "", nil, fmt.Errorf("read existing %s: %w", page.Path, err)
@@ -283,7 +267,7 @@ See brain/schema.md for the full schema.
 `
 
 func loadSchema(brainDir string) string {
-	b, err := readBrainFile(brainDir, "schema.md")
+	b, err := os.ReadFile(filepath.Join(brainDir, "schema.md"))
 	if err != nil {
 		return defaultSchema
 	}

ingestion/internal/pipeline/refs.go

@@ -2,6 +2,7 @@
 package pipeline
 
 import (
+	"os"
 	"path/filepath"
 	"regexp"
 	"strings"
@@ -52,7 +53,8 @@ func injectSourceRefs(pages []wiki.Page, inventory map[wiki.PageType][]wiki.Entr
 		if !ok {
 			continue
 		}
-		b, err := readBrainFile(brainDir, "wiki/"+string(pt)+"/"+slug+".md")
+		diskPath := filepath.Join(brainDir, "wiki", string(pt), slug+".md")
+		b, err := os.ReadFile(diskPath)
 		if err != nil {
 			continue
 		}

ingestion/internal/pipeline/root_test.go

@@ -1,167 +0,0 @@
-package pipeline
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"syscall"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs/brainfstest"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/wiki"
-)
-
-// hyperguild#157 slice 6: the pipeline read the source page, schema.md, the
-// pages it revises and the pages it adds source refs to with os.ReadFile, so
-// a symlinked file's content reached the LLM prompt and the written pages,
-// and a FIFO hung the ingest.
-
-func mkdirs(t *testing.T, brain string, dirs ...string) {
-	t.Helper()
-	for _, d := range dirs {
-		require.NoError(t, os.MkdirAll(filepath.Join(brain, filepath.FromSlash(d)), 0o755))
-	}
-}
-
-func TestReadSourcePageAndSchemaRefuseSymlinksAndSurviveSwapRaces(t *testing.T) {
-	brain := t.TempDir()
-	mkdirs(t, brain, "wiki/sources")
-	inBrain := brainfstest.WriteSentinelAt(t, filepath.Join(brain, "raw", "s.md"))
-	require.NoError(t, os.WriteFile(filepath.Join(brain, "wiki", "sources", "ok.md"), []byte("zqinside source"), 0o644))
-	require.NoError(t, os.WriteFile(filepath.Join(brain, "schema.md"), []byte("zqinside schema"), 0o644))
-	assert.Equal(t, "zqinside source", readSourcePage(brain, "ok"), "positive control")
-	assert.Equal(t, "zqinside schema", loadSchema(brain), "positive control")
-
-	require.NoError(t, os.Symlink(brainfstest.Outside(t), filepath.Join(brain, "wiki", "sources", "out.md")))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "raw", "s.md"), filepath.Join(brain, "wiki", "sources", "in.md")))
-	assert.NotContains(t, readSourcePage(brain, "out"), brainfstest.Sentinel)
-	assert.NotContains(t, readSourcePage(brain, "in"), brainfstest.Sentinel)
-	assert.NotContains(t, storedSourceHash(brain, "in"), brainfstest.Sentinel)
-
-	src := filepath.Join(brain, "wiki", "sources", "r.md")
-	read := func() string { return readSourcePage(brain, "r") }
-	brainfstest.AssertNoLeak(t, src, "zqinside", 1500*time.Millisecond, read)
-	brainfstest.AssertNoLeakFrom(t, src, "zqinside", inBrain, 1500*time.Millisecond, read)
-	brainfstest.AssertNoHang(t, src, "zqinside", 1500*time.Millisecond, 6*time.Second, func() { _ = read() })
-
-	schema := filepath.Join(brain, "schema.md")
-	rs := func() string { return loadSchema(brain) }
-	brainfstest.AssertNoLeakFrom(t, schema, "zqinside schema", inBrain, 1500*time.Millisecond, rs)
-	brainfstest.AssertNoHang(t, schema, "zqinside schema", 1500*time.Millisecond, 6*time.Second, func() { _ = rs() })
-}
-
-func TestReviseOrCreateRefusesASymlinkedExistingPage(t *testing.T) {
-	brain := t.TempDir()
-	mkdirs(t, brain, "wiki/concepts")
-	brainfstest.WriteSentinelAt(t, filepath.Join(brain, "raw", "s.md"))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "raw", "s.md"), filepath.Join(brain, "wiki", "concepts", "c.md")))
-	page := wiki.Page{Path: "wiki/concepts/c.md", Content: "---\ntitle: C\n---\nnew\n"}
-	out, _, err := reviseOrCreate(brain, page)
-	assert.Error(t, err)
-	assert.NotContains(t, out, brainfstest.Sentinel)
-
-	require.NoError(t, os.WriteFile(filepath.Join(brain, "wiki", "concepts", "d.md"), []byte("---\ntitle: D\n---\nzqold\n"), 0o644))
-	out, _, err = reviseOrCreate(brain, wiki.Page{Path: "wiki/concepts/d.md", Content: "---\ntitle: D\n---\nnew\n"})
-	require.NoError(t, err)
-	assert.Contains(t, out, "zqold", "positive control: the existing page is read")
-	out, _, err = reviseOrCreate(brain, wiki.Page{Path: "wiki/concepts/new.md", Content: "fresh"})
-	require.NoError(t, err)
-	assert.Equal(t, "fresh", out, "positive control: a missing page is created")
-}
-
-func TestInjectSourceRefsDoesNotReadASymlinkedPage(t *testing.T) {
-	brain := t.TempDir()
-	mkdirs(t, brain, "wiki/concepts")
-	brainfstest.WriteSentinelAt(t, filepath.Join(brain, "raw", "s.md"))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "raw", "s.md"), filepath.Join(brain, "wiki", "concepts", "c.md")))
-	require.NoError(t, os.WriteFile(filepath.Join(brain, "wiki", "concepts", "d.md"), []byte("zqinside d"), 0o644))
-	inv := map[wiki.PageType][]wiki.Entry{wiki.PageTypeConcept: {
-		{Slug: "c", Type: wiki.PageTypeConcept}, {Slug: "d", Type: wiki.PageTypeConcept},
-	}}
-	src := wiki.Page{Path: "wiki/sources/src.md", Content: "---\ntitle: Src\n---\nsee [[c|C]] and [[d|D]]\n"}
-	out := injectSourceRefs([]wiki.Page{src}, inv, brain)
-	got := fmt.Sprintf("%+v", out)
-	assert.Contains(t, got, "zqinside d", "positive control")
-	assert.NotContains(t, got, brainfstest.Sentinel)
-}
-
-func TestBackfillRefsSkipsSymlinkedSourcesAndPages(t *testing.T) {
-	brain := t.TempDir()
-	mkdirs(t, brain, "wiki/sources", "wiki/concepts", "raw")
-	require.NoError(t, os.WriteFile(filepath.Join(brain, "wiki", "concepts", "real.md"), []byte("---\ntitle: R\n---\nbody\n"), 0o644))
-	require.NoError(t, os.WriteFile(filepath.Join(brain, "wiki", "sources", "ok.md"), []byte("---\ntitle: zqinside\n---\n[[real|R]]\n"), 0o644))
-	// A source elsewhere in the brain whose title is the sentinel and which
-	// links the real concept with the [[slug|title]] form the pipeline follows.
-	require.NoError(t, os.WriteFile(filepath.Join(brain, "raw", "src.md"),
-		[]byte("---\ntitle: "+brainfstest.Sentinel+"\n---\n[[real|R]]\n"), 0o644))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "raw", "src.md"), filepath.Join(brain, "wiki", "sources", "in.md")))
-	// A concept page linked by the regular source that is itself a symlink.
-	require.NoError(t, os.WriteFile(filepath.Join(brain, "wiki", "sources", "ok2.md"), []byte("---\ntitle: Two\n---\n[[lnk|L]]\n"), 0o644))
-	brainfstest.WriteSentinelAt(t, filepath.Join(brain, "raw", "page.md"))
-	require.NoError(t, os.Symlink(filepath.Join("..", "..", "raw", "page.md"), filepath.Join(brain, "wiki", "concepts", "lnk.md")))
-
-	_, err := BackfillRefs(context.Background(), brain)
-	require.NoError(t, err)
-	b, _ := os.ReadFile(filepath.Join(brain, "wiki", "concepts", "real.md"))
-	assert.Contains(t, string(b), "zqinside", "positive control: the regular source's ref is added")
-	assert.NotContains(t, string(b), brainfstest.Sentinel, "a symlinked source's title was written as a ref")
-	raw, _ := os.ReadFile(filepath.Join(brain, "raw", "page.md"))
-	assert.NotContains(t, string(raw), "[[ok2", "the symlinked concept page's target was rewritten")
-}
-
-// A source swapped between a regular file and a symlink to an in-brain source
-// whose title is the sentinel: the read refuses the swapped-in link, so the
-// sentinel never lands in the concept page as a ref.
-func TestBackfillRefsDoesNotWriteARefFromASourceSwappedInBehindASymlink(t *testing.T) {
-	brain := t.TempDir()
-	mkdirs(t, brain, "wiki/sources", "wiki/concepts", "raw")
-	realPage := filepath.Join(brain, "wiki", "concepts", "real.md")
-	target := filepath.Join(brain, "raw", "src.md")
-	require.NoError(t, os.WriteFile(target, []byte("---\ntitle: "+brainfstest.Sentinel+"\n---\n[[real|R]]\n"), 0o644))
-	src := filepath.Join(brain, "wiki", "sources", "r.md")
-	inside := "---\ntitle: zqinside\n---\n[[real|R]]\n"
-	read := func() string {
-		_ = os.WriteFile(realPage, []byte("---\ntitle: R\n---\nbody\n"), 0o644)
-		_, _ = BackfillRefs(context.Background(), brain)
-		b, _ := os.ReadFile(realPage)
-		return string(b)
-	}
-	require.NoError(t, os.WriteFile(src, []byte(inside), 0o644))
-	require.Contains(t, read(), "zqinside", "positive control")
-	brainfstest.AssertNoLeakFrom(t, src, inside, target, 1500*time.Millisecond, read)
-}
-
-// A concept page that is regular when the inventory lists it, then swapped
-// for a symlink to an in-brain file before BackfillRefs reads it: only the
-// page read's own check refuses it (a static symlink never gets this far,
-// because LoadInventory does not list it).
-func TestBackfillRefsDoesNotCopyAPageSwappedInBehindASymlink(t *testing.T) {
-	brain := t.TempDir()
-	mkdirs(t, brain, "wiki/sources", "wiki/concepts", "raw")
-	require.NoError(t, os.WriteFile(filepath.Join(brain, "wiki", "sources", "s.md"), []byte("---\ntitle: S\n---\n[[c|C]]\n"), 0o644))
-	page := filepath.Join(brain, "wiki", "concepts", "c.md")
-	target := filepath.Join(brain, "raw", "secret.md")
-	inside := "---\ntitle: C\n---\nzqinside\n"
-	read := func() string {
-		// The write path still follows a swapped-in link (#158) and can
-		// overwrite the target, so restore it each round.
-		_ = os.WriteFile(target, []byte("---\ntitle: X\n---\n"+brainfstest.Sentinel+"\n"), 0o644)
-		_, _ = BackfillRefs(context.Background(), brain)
-		f, err := os.OpenFile(page, os.O_RDONLY|syscall.O_NOFOLLOW|syscall.O_NONBLOCK, 0)
-		if err != nil {
-			return ""
-		}
-		defer func() { _ = f.Close() }()
-		b, _ := io.ReadAll(f)
-		return string(b)
-	}
-	require.NoError(t, os.WriteFile(page, []byte(inside), 0o644))
-	require.Contains(t, read(), "[[s|S]]", "positive control: the regular page gets the source ref")
-	brainfstest.AssertNoLeakFrom(t, page, inside, target, 3*time.Second, read)
-}

ingestion/internal/startupretry/startupretry.go

@@ -0,0 +1,75 @@
+// Package startupretry retries a startup dependency that may not be serving
+// yet, instead of exiting on its first failure.
+//
+// It exists for the cold-boot ordering race (#83): on a cluster restart the
+// ingestion pod can reach OIDC discovery before dex is answering, gets a 502
+// from ingress, and dies — after having already connected postgres, backfilled
+// the graph and ingested session batches, all of which the restart redoes.
+// Nothing is misconfigured in that scenario; the pod simply started first.
+//
+// The budget is bounded on purpose. Retrying forever would turn a genuine
+// misconfiguration (wrong issuer URL, bad audience) into a process that looks
+// healthy and never serves, which is harder to diagnose than a crash loop.
+package startupretry
+
+import (
+	"context"
+	"fmt"
+	"time"
+)
+
+// Policy bounds the retry: at most Attempts calls, with the delay doubling
+// from Base and capped at Max.
+type Policy struct {
+	Attempts int           // total calls, including the first; < 1 means 1
+	Base     time.Duration // delay before the second attempt
+	Max      time.Duration // ceiling for the doubling delay
+}
+
+// Do calls fn until it succeeds, the attempt budget is spent, or ctx ends.
+//
+// The returned error wraps the last failure, so callers keep the diagnosis
+// they would have had without the retry.
+func Do[T any](ctx context.Context, p Policy, fn func(context.Context) (T, error)) (T, error) {
+	var zero T
+
+	attempts := p.Attempts
+	if attempts < 1 {
+		attempts = 1
+	}
+
+	delay := p.Base
+	var lastErr error
+
+	for i := range attempts {
+		if err := ctx.Err(); err != nil {
+			return zero, fmt.Errorf("startupretry: %w", err)
+		}
+
+		v, err := fn(ctx)
+		if err == nil {
+			return v, nil
+		}
+		lastErr = err
+
+		if i == attempts-1 {
+			break
+		}
+
+		if delay <= 0 {
+			delay = time.Second
+		}
+		if p.Max > 0 && delay > p.Max {
+			delay = p.Max
+		}
+
+		select {
+		case <-ctx.Done():
+			return zero, fmt.Errorf("startupretry: %w", ctx.Err())
+		case <-time.After(delay):
+		}
+		delay *= 2
+	}
+
+	return zero, fmt.Errorf("startupretry: gave up after %d attempts: %w", attempts, lastErr)
+}

ingestion/internal/startupretry/startupretry_test.go

@@ -0,0 +1,142 @@
+// ingestion/internal/startupretry/startupretry_test.go
+package startupretry
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+)
+
+func fastPolicy(attempts int) Policy {
+	return Policy{Attempts: attempts, Base: time.Millisecond, Max: 2 * time.Millisecond}
+}
+
+func TestDo_ReturnsImmediatelyOnFirstSuccess(t *testing.T) {
+	calls := 0
+	got, err := Do(context.Background(), fastPolicy(5), func(context.Context) (string, error) {
+		calls++
+		return "ready", nil
+	})
+	if err != nil {
+		t.Fatalf("Do: %v", err)
+	}
+	if got != "ready" {
+		t.Errorf("got %q, want %q", got, "ready")
+	}
+	if calls != 1 {
+		t.Errorf("calls = %d, want 1", calls)
+	}
+}
+
+func TestDo_SurvivesTransientFailuresThenSucceeds(t *testing.T) {
+	// The observed cold-boot race: dex is not serving yet, ingress answers
+	// 502 for the first few attempts, then discovery works.
+	calls := 0
+	got, err := Do(context.Background(), fastPolicy(5), func(context.Context) (string, error) {
+		calls++
+		if calls < 4 {
+			return "", errors.New("oidc discovery: status 502")
+		}
+		return "ready", nil
+	})
+	if err != nil {
+		t.Fatalf("Do returned %v — a transient 502 must not be fatal", err)
+	}
+	if got != "ready" {
+		t.Errorf("got %q, want %q", got, "ready")
+	}
+	if calls != 4 {
+		t.Errorf("calls = %d, want 4", calls)
+	}
+}
+
+func TestDo_GivesUpAfterTheAttemptBudgetAndReportsTheLastError(t *testing.T) {
+	// A genuinely broken issuer must still fail — retrying forever would turn
+	// a config error into a silent hang, which is worse than crash-looping.
+	last := errors.New("oidc discovery: status 404")
+	calls := 0
+
+	_, err := Do(context.Background(), fastPolicy(3), func(context.Context) (string, error) {
+		calls++
+		return "", last
+	})
+
+	if !errors.Is(err, last) {
+		t.Fatalf("err = %v, want it to wrap the last failure", err)
+	}
+	if calls != 3 {
+		t.Errorf("calls = %d, want 3 (the attempt budget)", calls)
+	}
+}
+
+func TestDo_StopsPromptlyWhenTheContextIsCancelled(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	calls := 0
+
+	done := make(chan struct{})
+	var err error
+	go func() {
+		defer close(done)
+		_, err = Do(ctx, Policy{Attempts: 100, Base: 50 * time.Millisecond, Max: time.Second},
+			func(context.Context) (string, error) {
+				calls++
+				if calls == 1 {
+					cancel()
+				}
+				return "", errors.New("still down")
+			})
+	}()
+
+	select {
+	case <-done:
+	case <-time.After(2 * time.Second):
+		t.Fatal("Do did not return after context cancellation")
+	}
+	if !errors.Is(err, context.Canceled) {
+		t.Errorf("err = %v, want context.Canceled", err)
+	}
+}
+
+func TestDo_BacksOffAndIsCappedByMax(t *testing.T) {
+	var delays []time.Duration
+	p := Policy{Attempts: 5, Base: 10 * time.Millisecond, Max: 25 * time.Millisecond}
+
+	last := time.Now()
+	_, _ = Do(context.Background(), p, func(context.Context) (string, error) {
+		now := time.Now()
+		delays = append(delays, now.Sub(last))
+		last = now
+		return "", errors.New("down")
+	})
+
+	// delays[0] is the first call (no wait); the rest are the sleeps.
+	if len(delays) != 5 {
+		t.Fatalf("attempts = %d, want 5", len(delays))
+	}
+	if delays[1] >= delays[2] {
+		t.Errorf("backoff is not growing: %v then %v", delays[1], delays[2])
+	}
+	for i, d := range delays[1:] {
+		if d > 2*p.Max {
+			t.Errorf("delay %d = %v, exceeds the Max cap %v with slack", i+1, d, p.Max)
+		}
+	}
+}
+
+func TestPolicy_ZeroValueStillMakesOneAttempt(t *testing.T) {
+	// A caller that forgets to configure the policy must not silently get a
+	// no-op that returns a nil validator and a nil error.
+	calls := 0
+	_, err := Do(context.Background(), Policy{}, func(context.Context) (string, error) {
+		calls++
+		return "", errors.New("down")
+	})
+
+	if calls != 1 {
+		t.Errorf("calls = %d, want 1", calls)
+	}
+	if err == nil {
+		t.Error("err = nil, want the failure surfaced")
+	}
+}

ingestion/internal/symlinkguard/symlinkguard.go

@@ -18,14 +18,9 @@ import (
 	"sort"
 	"strconv"
 	"strings"
-	"sync"
-	"sync/atomic"
 	"time"
 )
 
-// shutdownFlushTimeout bounds the final flush when Watch stops.
-var shutdownFlushTimeout = 5 * time.Second
-
 // DefaultInterval is used when Watch is given a non-positive interval.
 const DefaultInterval = 30 * time.Second
 
@@ -138,32 +133,13 @@ func Scan(brainDir string) (Result, error) {
 // queue until Notify succeeds (see alertQueue): an outage delays them, and
 // any that do not fit the bounded queue, or are undeliverable, are counted in
 // a summary that is never dropped, so every incident is delivered or counted.
-//
-// Delivery runs in its own goroutine (hyperguild#164): a hung notifier, with
-// a full queue, blocked one flush for several notify timeouts, and while the
-// scan waited on it a planted link stayed readable for several intervals.
-// The scan hands alerts over without blocking; any that do not fit are
-// counted in the summary. When ctx ends, Watch returns after a final flush
-// of what was handed over (bounded by shutdownFlushTimeout); alerts that
-// flush cannot deliver are counted in one error log line instead. That
-// shutdown path only runs for a caller that cancels ctx: cmd/server passes
-// context.Background(), so in production the flush on handoff is what keeps
-// alerts from waiting on a restart.
 func Watch(ctx context.Context, brainDir string, interval time.Duration, n Notifier) {
 	if interval <= 0 {
 		interval = DefaultInterval
 	}
 	t := time.NewTicker(interval)
 	defer t.Stop()
-	alerts := make(chan string, maxPending)
+	q := &alertQueue{}
-	var overflow atomic.Int64
-	var wg sync.WaitGroup
-	wg.Add(1)
-	go func() { defer wg.Done(); deliver(ctx, interval, n, alerts, &overflow) }()
-	// The scan is the only sender: closing alerts tells deliver to drain and
-	// flush once more, and Watch returns only after it has.
-	defer func() { close(alerts); wg.Wait() }()
-	q := alertSender{alerts: alerts, overflow: &overflow}
 	reported := ""
 	for {
 		select {
@@ -192,76 +168,7 @@ func Watch(ctx context.Context, brainDir string, interval time.Duration, n Notif
 					". Readers may follow symlinks out of the brain; fix them.")
 			}
 		}
-	}
+		q.flush(ctx, n)
-}
-
-// alertSender hands alerts to deliver without ever blocking the scan; an
-// alert that does not fit is counted in overflow, which deliver adds to the
-// summary.
-type alertSender struct {
-	alerts   chan<- string
-	overflow *atomic.Int64
-}
-
-func (s alertSender) push(msg string) {
-	select {
-	case s.alerts <- msg:
-	default:
-		s.overflow.Add(1)
-	}
-}
-
-// deliver owns the alertQueue. It flushes as soon as an alert is handed
-// over, and again every interval while any are pending (outage retries).
-// When alerts is closed (Watch is stopping) it drains it and flushes once
-// more, bounded by shutdownFlushTimeout, so an alert handed over just before
-// shutdown is not lost (PR #180 review). Whatever that flush cannot deliver
-// is logged as one error with its counts, never dropped silently.
-func deliver(ctx context.Context, interval time.Duration, n Notifier, alerts <-chan string, overflow *atomic.Int64) {
-	t := time.NewTicker(interval)
-	defer t.Stop()
-	q := &alertQueue{}
-	// drain moves everything handed over into the queue; it reports false
-	// once alerts is closed.
-	drain := func() bool {
-		defer func() { q.suppressed += int(overflow.Swap(0)) }()
-		for {
-			select {
-			case msg, ok := <-alerts:
-				if !ok {
-					return false
-				}
-				q.push(msg)
-			default:
-				return true
-			}
-		}
-	}
-	for {
-		select {
-		case msg, ok := <-alerts:
-			if ok {
-				q.push(msg)
-				ok = drain()
-			}
-			if !ok {
-				q.suppressed += int(overflow.Swap(0))
-				fctx, cancel := context.WithTimeout(context.WithoutCancel(ctx), shutdownFlushTimeout)
-				q.flush(fctx, n)
-				cancel()
-				if len(q.items) > 0 || q.suppressed > 0 {
-					slog.Error("symlink tripwire alerts not delivered at shutdown",
-						"undelivered", len(q.items), "suppressed", q.suppressed)
-				}
-				return
-			}
-			q.flush(ctx, n)
-		case <-t.C:
-			if !drain() {
-				continue // the closed channel is handled by the case above
-			}
-			q.flush(ctx, n)
-		}
 	}
 }
 

ingestion/internal/symlinkguard/symlinkguard_test.go

@@ -1,12 +1,10 @@
 package symlinkguard
 
 import (
-	"bytes"
 	"context"
 	"errors"
 	"fmt"
 	"os"
-	"log/slog"
 	"path/filepath"
 	"strconv"
 	"strings"
@@ -347,19 +345,13 @@ func TestWatchDropsAMessageThatNeverSendsSoLaterAlertsFlow(t *testing.T) {
 	}, 3*time.Second, 10*time.Millisecond, "a later alert is delivered despite a poison message")
 }
 
-// toggleNotifier fails while down is set. Like the real audit.NtfyNotifier
+// toggleNotifier fails while down is set.
-// (http.NewRequestWithContext), it also fails, without recording, when its
-// ctx is already done (PR #180 round 2: notifiers that ignored ctx let a
-// final flush on the cancelled ctx pass).
 type toggleNotifier struct {
 	recNotifier
 	down atomic.Bool
 }
 
 func (r *toggleNotifier) Notify(ctx context.Context, m string) error {
-	if err := ctx.Err(); err != nil {
-		return err
-	}
 	if r.down.Load() {
 		return errors.New("ntfy down")
 	}
@@ -504,271 +496,3 @@ func TestWatchDropsAPoisonMessageAndCountsIt(t *testing.T) {
 		return false
 	}, 3*time.Second, 5*time.Millisecond, "the dropped poison alert is counted in a summary")
 }
-
-// hungNotifier answers every Notify only after latency (or when ctx ends),
-// with an outage error: an ntfy that accepts connections but never responds
-// until its timeout.
-type hungNotifier struct{ latency time.Duration }
-
-func (h hungNotifier) Notify(ctx context.Context, _ string) error {
-	select {
-	case <-time.After(h.latency):
-	case <-ctx.Done():
-	}
-	return errors.New("ntfy timeout")
-}
-
-func waitGone(t *testing.T, link string) {
-	t.Helper()
-	require.Eventually(t, func() bool { _, err := os.Lstat(link); return os.IsNotExist(err) }, 10*time.Second, time.Millisecond)
-}
-
-// hyperguild#164: alerts were flushed in the scan goroutine, so with a hung
-// ntfy and a full queue one flush (6 x notify timeout) delayed the next scan.
-// The notifier here is slower than the interval, as in production (10 s
-// timeout vs 30 s interval with 6 messages), so the alert handoff is full:
-// a scan that waited on it would keep a link for seconds.
-func TestWatchLinkLifetimeStaysNearOneIntervalWithANotifierSlowerThanTheInterval(t *testing.T) {
-	const interval = 100 * time.Millisecond
-	brain := t.TempDir()
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	go Watch(ctx, brain, interval, hungNotifier{latency: 400 * time.Millisecond})
-
-	for i := 0; i < 2*maxPending+3; i++ { // overfill queue and handoff
-		link := filepath.Join(brain, "fill"+strconv.Itoa(i))
-		require.NoError(t, os.Symlink(t.TempDir(), link))
-		waitGone(t, link)
-	}
-	var worst time.Duration
-	for i := 0; i < 6; i++ {
-		link := filepath.Join(brain, "probe"+strconv.Itoa(i))
-		require.NoError(t, os.Symlink(t.TempDir(), link))
-		planted := time.Now()
-		waitGone(t, link)
-		worst = max(worst, time.Since(planted))
-	}
-	assert.LessOrEqual(t, worst, interval+interval/2, "worst link lifetime %v with a hung notifier", worst)
-}
-
-// Review of PR #180: delivery waited for its own tick, about one interval
-// after the removal. An alert is now flushed as soon as it is handed over.
-func TestWatchDeliversARemovalAlertWellWithinOneInterval(t *testing.T) {
-	const interval = 400 * time.Millisecond
-	brain := t.TempDir()
-	n := &recNotifier{}
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	go Watch(ctx, brain, interval, n)
-	link := filepath.Join(brain, "prompt")
-	require.NoError(t, os.Symlink(t.TempDir(), link))
-	waitGone(t, link)
-	removed := time.Now()
-	require.Eventually(t, func() bool { return n.count() == 1 }, 2*time.Second, time.Millisecond)
-	assert.Less(t, time.Since(removed), interval/4)
-}
-
-// Review of PR #180: on ctx end, deliver returned without draining what the
-// scan had handed over, so a removal just before shutdown was neither
-// delivered nor counted. Watch now drains and flushes before returning.
-func TestWatchDeliversAnAlertHandedOverJustBeforeShutdown(t *testing.T) {
-	for i := 0; i < 20; i++ {
-		brain := t.TempDir()
-		n := &recNotifier{}
-		ctx, cancel := context.WithCancel(context.Background())
-		done := make(chan struct{})
-		go func() { Watch(ctx, brain, 5*time.Millisecond, n); close(done) }()
-		link := filepath.Join(brain, "late")
-		require.NoError(t, os.Symlink(t.TempDir(), link))
-		waitGone(t, link)
-		cancel()
-		<-done
-		require.Equal(t, 1, n.count(), "iteration %d: the removal alert was lost at shutdown", i)
-	}
-}
-
-// blockingNotifier holds every Notify until its ctx ends, tracking calls in
-// flight.
-type blockingNotifier struct{ inFlight atomic.Int32 }
-
-func (b *blockingNotifier) Notify(ctx context.Context, _ string) error {
-	b.inFlight.Add(1)
-	defer b.inFlight.Add(-1)
-	<-ctx.Done()
-	return ctx.Err()
-}
-
-// Watch does not return while its delivery goroutine is still notifying.
-func TestWatchReturnsOnlyAfterDeliveryHasStopped(t *testing.T) {
-	prev := shutdownFlushTimeout
-	shutdownFlushTimeout = 50 * time.Millisecond
-	t.Cleanup(func() { shutdownFlushTimeout = prev })
-	brain := t.TempDir()
-	n := &blockingNotifier{}
-	ctx, cancel := context.WithCancel(context.Background())
-	done := make(chan struct{})
-	go func() { Watch(ctx, brain, 5*time.Millisecond, n); close(done) }()
-	link := filepath.Join(brain, "x")
-	require.NoError(t, os.Symlink(t.TempDir(), link))
-	waitGone(t, link)
-	require.Eventually(t, func() bool { return n.inFlight.Load() == 1 }, 2*time.Second, time.Millisecond)
-	cancel()
-	select {
-	case <-done:
-	case <-time.After(5 * time.Second):
-		t.Fatal("Watch did not return after cancel")
-	}
-	assert.Zero(t, n.inFlight.Load(), "Notify still running after Watch returned")
-}
-
-// slowToggleNotifier fails slowly (a hung ntfy) while down, then records.
-type slowToggleNotifier struct {
-	recNotifier
-	down    atomic.Bool
-	latency time.Duration
-}
-
-func (r *slowToggleNotifier) Notify(ctx context.Context, m string) error {
-	if r.down.Load() {
-		select {
-		case <-time.After(r.latency):
-		case <-ctx.Done():
-		}
-		return errors.New("ntfy timeout")
-	}
-	return r.recNotifier.Notify(ctx, m)
-}
-
-// Review of PR #180: with a slow notifier the scan's handoff overflows, and
-// those alerts exist only in the overflow counter. Every removal is still
-// delivered or counted in the summary.
-func TestWatchCountsHandoffOverflowWithASlowNotifier(t *testing.T) {
-	brain := t.TempDir()
-	n := &slowToggleNotifier{latency: 30 * time.Millisecond}
-	n.down.Store(true)
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	go Watch(ctx, brain, 2*time.Millisecond, n)
-	const plants = 40
-	for i := 0; i < plants; i++ {
-		link := filepath.Join(brain, "ov"+strconv.Itoa(i))
-		require.NoError(t, os.Symlink(t.TempDir(), link))
-		waitGone(t, link)
-	}
-	n.down.Store(false)
-	delivered, counted := 0, 0
-	require.Eventually(t, func() bool {
-		n.mu.Lock()
-		defer n.mu.Unlock()
-		delivered, counted = 0, 0
-		for _, m := range n.msgs {
-			if strings.Contains(m, "removed 1 symlink(s)") {
-				delivered++
-			}
-			if i := strings.Index(m, "): "); i >= 0 && strings.Contains(m, "suppressed") {
-				var c int
-				_, _ = fmt.Sscanf(m[i+3:], "%d", &c)
-				counted += c
-			}
-		}
-		return delivered+counted == plants
-	}, 5*time.Second, 10*time.Millisecond, "delivered %d + counted %d of %d", delivered, counted, plants)
-}
-
-// An alert still queued when Watch stops (its send failed, the notifier has
-// since recovered, the retry tick has not come) is flushed once more before
-// Watch returns, on a ctx that is not the cancelled one: toggleNotifier fails
-// on a done ctx, as the real ntfy notifier does.
-func TestWatchFinalFlushSendsAQueuedAlertOnACtxThatOutlivesTheCancel(t *testing.T) {
-	brain := t.TempDir()
-	n := &toggleNotifier{}
-	n.down.Store(true)
-	ctx, cancel := context.WithCancel(context.Background())
-	done := make(chan struct{})
-	go func() { Watch(ctx, brain, 300*time.Millisecond, n); close(done) }()
-	link := filepath.Join(brain, "queued")
-	require.NoError(t, os.Symlink(t.TempDir(), link))
-	waitGone(t, link)
-	time.Sleep(20 * time.Millisecond) // let the immediate send fail
-	n.down.Store(false)
-	cancel()
-	<-done
-	assert.Equal(t, 1, n.count(), "the queued alert was not flushed at shutdown")
-}
-
-// lockedBuffer is a goroutine-safe log sink: Watch goroutines of earlier
-// tests may still log while one test captures.
-type lockedBuffer struct {
-	mu  sync.Mutex
-	buf bytes.Buffer
-}
-
-func (b *lockedBuffer) Write(p []byte) (int, error) {
-	b.mu.Lock()
-	defer b.mu.Unlock()
-	return b.buf.Write(p)
-}
-
-func (b *lockedBuffer) String() string { b.mu.Lock(); defer b.mu.Unlock(); return b.buf.String() }
-
-func captureLog(t *testing.T) *lockedBuffer {
-	t.Helper()
-	b := &lockedBuffer{}
-	prev := slog.Default()
-	slog.SetDefault(slog.New(slog.NewTextHandler(b, nil)))
-	t.Cleanup(func() { slog.SetDefault(prev) })
-	return b
-}
-
-// PR #180 round 2: when the final flush fails (ntfy hung at shutdown) the
-// undelivered alerts vanished with only "will retry" warnings. Watch now logs
-// one error with both counts.
-func TestWatchLogsUndeliveredAndSuppressedCountsWhenTheFinalFlushFails(t *testing.T) {
-	prev := shutdownFlushTimeout
-	shutdownFlushTimeout = 50 * time.Millisecond
-	t.Cleanup(func() { shutdownFlushTimeout = prev })
-	logs := captureLog(t)
-	brain := t.TempDir()
-	ctx, cancel := context.WithCancel(context.Background())
-	done := make(chan struct{})
-	go func() { Watch(ctx, brain, 5*time.Millisecond, hungNotifier{latency: time.Hour}); close(done) }()
-	link := filepath.Join(brain, "lost")
-	require.NoError(t, os.Symlink(t.TempDir(), link))
-	waitGone(t, link)
-	cancel()
-	<-done
-	out := logs.String()
-	assert.Contains(t, out, "level=ERROR")
-	assert.Contains(t, out, `msg="symlink tripwire alerts not delivered at shutdown"`)
-	assert.Contains(t, out, "undelivered=1")
-	assert.Contains(t, out, "suppressed=0")
-}
-
-// deliver, given a handoff that already holds alerts and is closed, moves them
-// into the queue and runs the final flush, even though the ctx is cancelled:
-// the drain-on-close path, without depending on when the close lands.
-func TestDeliverFlushesAlertsDrainedFromAClosedHandoffOnACancelledCtx(t *testing.T) {
-	alerts := make(chan string, 3)
-	alerts <- "a1"
-	alerts <- "a2"
-	close(alerts)
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-	n := &toggleNotifier{}
-	var overflow atomic.Int64
-	deliver(ctx, time.Hour, n, alerts, &overflow)
-	assert.Equal(t, []string{"a1", "a2"}, n.msgs)
-}
-
-// PR #180 round 2: when the first receive after close finds the handoff empty,
-// overflow counted by the scan was never moved into the summary.
-func TestDeliverCountsOverflowWhenTheHandoffIsClosedAndEmpty(t *testing.T) {
-	alerts := make(chan string)
-	close(alerts)
-	n := &recNotifier{}
-	var overflow atomic.Int64
-	overflow.Store(3)
-	deliver(context.Background(), time.Hour, n, alerts, &overflow)
-	require.Len(t, n.msgs, 1)
-	assert.Contains(t, n.msgs[0], "3 further alert(s)")
-}