Add renovate.json

2026-08-15 05:28:45 +00:00
142 changed files with 1212 additions and 10687 deletions
@@ -64,11 +64,7 @@ the routing pod; brain tools moved to the brain MCP.
 The brain HTTP REST API (`/query`, `/write`, `/ingest`, `/ingest-raw`,
 `/ingest-path`, `/backfill-refs`, `/pass-rate`) remains available on port 3300
-for shell scripts and non-MCP clients, **with the same bearer token as `/mcp`**
+for shell scripts and non-MCP clients.
 (`BRAIN_MCP_TOKEN`; hyperguild#149). It is not served on the public host
 (infra#517): use the tailnet (`koala:8443`) or in-cluster
 `ingestion.supervisor.svc:3300`. `/ingest-path` and `brain_ingest` `path`
 accept only paths inside `brain/raw/`.
 `brain_answer(query)` performs BM25 retrieval + LLM synthesis (berget.ai
 gemma4:31b → iguana fallback). `brain_classify(text)` infers doc type, title,
@@ -7,29 +7,6 @@
    "supervisor": {
      "url": "http://localhost:3200/mcp",
      "description": "Hyperguild SDO — skill workers (tdd, retrospective), brain tools (brain_query, brain_write), session logging, tier detection"
    },
    "brain": {
      "type": "http",
      "url": "https://koala.tail30472e.ts.net:8443/mcp",
      "headers": {
        "Authorization": "Bearer ${BRAIN_MCP_TOKEN}"
      }
    },
    "gitea": {
      "_comment": "gitea-mcp authenticates by PASS-THROUGH: the bearer is a Gitea PAT it validates against Gitea and then acts as. GITEA_MCP_TOKEN -- which this entry used until 2026-09-08 -- 401s against it, so every harness synced from this file had a dead gitea server and no signal saying so. Probed 2026-09-08: GITEA_MCP_TOKEN 401, DMABE_GITEA_API_TOKEN 200, on both the public and the Serve URL.",
      "type": "http",
      "url": "https://koala.tail30472e.ts.net:8446/mcp",
      "headers": {
        "Authorization": "Bearer ${DMABE_GITEA_API_TOKEN}"
      }
    },
    "infra": {
      "_comment": "The bearer is belt-and-braces: this endpoint answers 200 with or without it, since Serve already limits reach to the tailnet. Sending it anyway means the day the server starts enforcing is not the day every harness breaks.",
      "type": "http",
      "url": "https://koala.tail30472e.ts.net:8444/mcp",
      "headers": {
        "Authorization": "Bearer ${INFRA_MCP_TOKEN}"
      }
    }
  }
 }
@@ -53,51 +53,14 @@ These rules apply to every task across every project, regardless of harness.
   logical change (one tool, one fix, one test) with passing tests. Main is always
   deployable. Never create long-lived feature branches.
-   **The PR trigger is RISK, not concurrency.** `risk/low` work commits straight to
+   **Exception — parallel agents on same repo:** If another agent is known to be
-   main with CI as the gate — that is most work and is unchanged. `risk/medium` and
+   actively working on the same repo simultaneously, create a short-lived branch
-   above opens a PR, even solo, even with nobody waiting to review it. This mirrors
+   (`agent/<description>`), finish the task, and merge to main within the same
-   the tiered merge model in `assessor-loop`
+   session. Do not leave agent branches open between sessions.
   `method/transfer-to-a-regulated-organisation.md` §4.1, so the estate practises
   what it sells instead of merging everything on green and claiming otherwise.
-   **Concurrency is NOT a reason to branch.** Measured 2026-08-29 across three real
+   **Exception — external contributor or client four-eyes requirement:** Use
-   collisions between parallel sessions: two were not branching problems at all — a
+   PR flow only when a human reviewer outside the project is required. Document
-   generated artifact written to the same path by both (branching turns that into a
+   the reason in PROJECT.md.
   merge conflict on a 33k-line JSON), and uncommitted work in a shared checkout
   (a per-session worktree fixes it) — and the third was an ordinary non-fast-forward
   push resolved by rebase in seconds. Use a worktree per session on shared repos and
   timestamp generated artifacts. Do not reach for a branch.
   Branch+PR flow carries documented costs on solo repos: merging auto-closes gated
   issues, review comments live on a thread separate from the issue's, and a
   merged-and-deleted branch cannot be amended (brain:
   `gitea-pr-merge-autoclose-and-review-comment-footguns`). Those are the price of
   the `risk/medium`+ lane — paid deliberately, not incurred by accident.
   **Exception — external contributor or client four-eyes requirement:** Use PR flow
   when a human reviewer outside the project is required. Document the reason in
   PROJECT.md.
   **Exception — a GitOps repo where a branch cannot be reconciled.** In a repo whose
   deployment watches one branch (`mathias/infra`: Flux watches `main`), a branch is
   invisible to the thing that applies it. A `risk/medium` change to `alerts.yaml` or
   `litellm-config.yaml` can be linted on a branch but never *exercised* there, so a
   PR would buy a review of a state that was never deployed.
   There, `risk/medium`+ work stays on `main` and instead requires a **recorded
   adversarial review pass before the push** — `skills:pr-gatekeeper` or equivalent,
   reviewing the staged diff. **The reviewer's verdict goes in the issue, not a PR
   thread.** No verdict recorded means the lane was not used, and saying "the gate was
   green" is not the same claim.
   Be honest about what this is: a recorded *independent* pass, not four-eyes in the
   sense `assessor-loop` §4.1 means for a regulated organisation, because the reviewer
   is an agent. It is more than the repo had and less than the model it mirrors; do not
   describe it as the stronger property. (infra#470, decided 2026-09-29.)
   This lane depends on the `risk/` label being right. A label that triggers a heavier
   lane is load-bearing, not cosmetic — if work that belongs in it is unlabelled, the
   lane silently does not apply.
 6. **Close the loop — every substantive task ends with the same ritual.** Shipping
   the code is not the end of the task; capturing it is. Run this unprompted:
@@ -115,63 +78,6 @@ These rules apply to every task across every project, regardless of harness.
   - Surface the brain entries and issue numbers in the closing summary so the
     trail is auditable.
   **Chat is not a durable store. Never rely on Mathias remembering anything.**
   Every gap, caveat, risk, open question and next step must land in one of four
   places before the turn ends: **the brain**, **a repo** (code, docs, ADR),
   **a tracker issue**, or **a plan file**. A finding stated only in conversation is
   lost the moment the session closes — and this estate has repeatedly proved that a
   remembered convention is an unreliable control.
   This applies hardest to what is tempting to leave as a closing remark: "worth
   knowing X isn't enforced yet", "this is a convention, not a gate", "we should
   revisit Y". Those are exactly the items that need a locator. If it is worth
   saying in a summary, it is worth writing where it can be found again without you.
 7. **Finish what's closable — only involve me for a genuine call.** If a
   tracker issue, PR, or checklist item is demonstrably resolved — the fix
   landed, the state changed, you verified it live — close/merge/check it off
   in the same turn. Don't leave it open "for the record" or park it waiting
   on me to confirm something that already happened; that's bookkeeping, not
   a decision. Reserve asking me (`AskUserQuestion`, a `DECISION NEEDED`
   comment, or otherwise pausing) for when it's genuinely mine to call:
   irreversible or prod/host-impacting actions, a real judgment call with no
   clearly-better option, ambiguous intent, or anything secret-writes/
   destructive-git already gate. Before claiming something is closable,
   verify it live (re-check the issue, re-run the command) rather than
   trusting your own earlier summary (brain: `filed-issue-not-same-as-fixed`).
 8. **Control code needs an adversary, not a checklist.** Code whose job is to
   refuse, deny, gate or contain is not adequately verified by a green gate.
   Rule 5 makes CI the quality gate and that holds for ordinary work — but a
   passing suite only asserts what its author already thought of, and for a
   control the author is precisely the person whose imagination just failed.
   Measured on `dispatch#75`: five review rounds, five real escapes verified by
   execution, and **CI was green on every one of them** while `git rm
   ././.dispatch-allow` deleted the file the control existed to protect. So
   route this work through a review with authority to block, instructed to
   verify by execution rather than by reading the implementation. Expect to be
   blocked more than once; that is the control working, not the reviewer being
   difficult. (brain: `a-green-gate-is-not-evidence-for-control-code`; the
   practices live in the `pr-gatekeeper` agent.)
 9. **A test's name must not claim more than its assertions prove.** Name a test
   after the mechanism it observes, not the goal it serves.
   `DoesNotInheritEnv` is honest; `IsContained` is a claim the test cannot
   support. This is not pedantry about naming — when name and assertion
   diverge, the name wins in the reader's head and the gap becomes invisible,
   which is what lets the defect survive review. Found three times in one PR,
   twice in tests written to fix the previous instance of it; each passed while
   the thing it was named for was exploitable. If you cannot name the mechanism,
   you do not yet know what the test observes.
 ## CAD sprint patterns
 Two CAD sprint archetypes (defs: brain `wiki/homelab/decisions/continuous-agentic-development-cad-concept-2026-06-16`):
 - **Inception Sprint** — birth a new repo. Oath-gated close; tag only once every clause holds. Brain: `.../inception-sprint-and-oath`.
 - **Sweep Sprint** — clear an existing backlog. Parallel read-only research per issue → sequential one-issue-per-commit execution. Brain: `.../sweep-sprint-and-oath`.
 Shared: decisions that are yours, not the agent's, surface as `DECISION NEEDED` (question/options/recommendation/blocks) — ask live if you're present, else comment and wait, never act past it. Live-breaking regressions get `git revert`, never forward-fixed; host-network work skips even read-only research (solo, synchronous, you present). Rule 6's closing ritual only fires once every Oath clause genuinely holds — blocked = descoped-and-tracked, never marked done.
 ## Default stack
 | Layer | Default | Fallback | Last resort |
@@ -234,10 +140,10 @@ Three machines on Tailscale:
 |---------|------|-----------|
 | koala | GPU inference, heavy compute | RTX 5070, runs k3s + llama-swap + shared postgres18/pgvector |
 | iguana | Services, builds | M2 Ultra Mac |
-| flamingo | Daily driver, edge | Apple Silicon Mac, ~/dev is here |
+| flamingo | Daily driver, edge | Mac mini, ~/dev is here |
 - **Model routing**: LiteLLM in front of llama-swap (local) + cloud APIs (when permitted)
- **Orchestration**: k3s on koala only — single control-plane node, no workers (verified 2026-08-30). iguana and flamingo are on the tailnet but are not cluster members
+- **Orchestration**: k3s cluster across all three machines
 - **Networking**: Tailscale mesh
 ## Project landscape
@@ -304,16 +210,10 @@ entries that age well are about *why*, *how to avoid*, and *what to do when*.
 |---------|-------|-------|
 | **Claude Code, Claude Desktop** | `brain_query` (BM25), `brain_answer` (LLM-synth + sources) MCP tools | `brain_write` MCP tool |
 | **Crush, Pi, Antigravity, other MCP-capable** | same MCP server: `ingestion-brain` (via the `mcp__*_brain__*` namespace once authenticated) | same |
-| **Anything HTTP-only (curl, scripts)** | Tailnet only: `POST https://koala.tail30472e.ts.net:8443/query` with `{"query":"..."}`, sending `BRAIN_MCP_TOKEN` (not yet enforced on REST, hyperguild#149). The public `brain-mcp.d-ma.be` serves `/mcp` only (infra#517). | `POST .../write` with `{"content":"...","wing":"...","hall":"..."}` |
+| **Anything HTTP-only (curl, scripts)** | `POST https://brain-mcp.d-ma.be/query` with `{"query":"..."}` (auth via `BRAIN_MCP_TOKEN`) | `POST .../write` with `{"content":"...","filename":"..."}` |
 | **Browser / human inspection** | `https://git.d-ma.be/mathias/hyperguild` → `knowledge/` and `wiki/` markdown files |
- **Scoping — the brain holds no confidential client content.** Nothing on the read path
+- **Scoping**: defaults to `public` collection; client projects filter to `{client}` + `public`.
  filters by client: every token holder can read every wing, and `wing` on `brain_query`
  is an optional argument, not an access control. Client confidentiality is enforced only
  at write time (`capture`'s I1 gate refuses internal/confidential). So never `brain_write`
  client material; generalise it first or keep it in the client's own repo. (hyperguild#144,
  decided 2026-10-01. This line previously claimed client projects were filtered; they
  were not.)
 - **Routing**: brain_answer's LLM uses berget.ai as primary, iguana ollama as
  fallback. Both are configurable in the `supervisor/ingestion-deployment.yaml`
  on the koala k3s cluster; don't hardcode local-only model names into the
@@ -339,11 +239,10 @@ When working on a project tagged with a client name:
 ## Harness-agnostic principles
-Supported harnesses (2026-09-01) — Cursor and Aider were dropped; do not
+This context is designed to work with any AI coding tool:
-re-add adapters for them:
+- Claude Code, Cursor, Aider, Open WebUI, Charmbracelet Mods/Crush
- Claude Code, Antigravity, OpenCode, Mistral Vibe, Crush, Pi Coding Agent
+- Pi Coding Agent, Mistral Vibe, Antigravity
- Open WebUI, Charmbracelet Mods, or any tool that takes a system prompt string
+- Any tool that accepts a system prompt or reads a markdown context file
 - Any other tool that reads `AGENTS.md`, which is the de facto convention
 The canonical source is always `.context/AGENT.md` (root) and `.context/PROJECT.md` (per-project).
 Derived files are committed (see *How context propagates* below) so a `git pull` on any host yields full agent context with no setup.
@@ -355,65 +254,26 @@ Canonical sources of truth:
 - Project: `<repo>/.context/PROJECT.md` (per-repo)
 Derived files (committed, regenerated by `task context:sync`):
- `CLAUDE.md`, `AGENTS.md`, `.context/system-prompt.txt`
+- `CLAUDE.md`, `AGENTS.md`, `.cursorrules`, `.aider.conventions.md`,
-
+  `.context/system-prompt.txt`
 Repos still carrying `.cursorrules`, `.aider.conventions.md` or
 `.aider.conf.yml` are stale: nothing regenerates them. Delete them the next time
 you touch the repo, along with their entries in that repo's `task check`
 assertion.
 Workflow:
 1. Edit a canonical file. Run `task context:sync`. Commit canonical and
   derived together. Push.
-2. On any other host, `git pull` brings both. Which file a harness reads does
+2. On any other host, `git pull` brings both. Claude Code (tree-walking)
-   NOT split cleanly by lookup strategy, so do not reason from the strategy:
+   uses `CLAUDE.md`; Crush / Pi / Antigravity (cwd-only) use `AGENTS.md`;
-   - `CLAUDE.md` — Claude Code (walks up the tree)
+   Cursor uses `.cursorrules`; Aider uses `.aider.conventions.md`.
   - `AGENTS.md` — Crush, Pi, Antigravity (cwd-only), OpenCode (project root,
     global at `~/.config/opencode/AGENTS.md`), and Mistral Vibe, which **walks
     up** from cwd and takes the first `AGENTS.md` it finds
     (user-level `~/.vibe/AGENTS.md`)
   - `.context/system-prompt.txt` — Open WebUI, Mods, raw API calls; not read by
     any harness, it is for pasting
   Vibe tree-walks for `AGENTS.md`, so "tree-walkers use CLAUDE.md" is false.
   Each repo's `AGENTS.md` embeds the canonical and is the first one found from
   inside that repo, so this works — but by construction, not by luck.
 3. `task check` runs `context:sync` then asserts `git status --porcelain`
   is empty over the derived files (catches both modified-tracked drift
   and missing-untracked adapters). A drift fails the check with a
   message telling you to stage the regenerated files.
-Behavior rules in this file and per-project rules in `PROJECT.md` apply on every
+Behavior rules in this file and per-project rules in `PROJECT.md` apply
-host and every harness.
+unconditionally on every host, every harness.
 **Where a project rule contradicts a rule here, the project rule governs — and it
 must state its reason.** Both halves matter: the project file wins because it knows
 something this file cannot (infra's Flux constraint is real and not visible from
 here), and it must say why because a bare override is indistinguishable from drift.
 This replaces the previous wording, which said rules here and in `PROJECT.md` both
 apply *"unconditionally"*. That was not a tiebreak but a contradiction, and it went
 unnoticed until rule 5 and infra's "never create feature branches" had to be obeyed
 at the same time (infra#470). A standard can hold two individually sensible clauses
 that are jointly unsatisfiable, and survive for as long as everyone reads it
 charitably — the same failure the Inception Sprint Oath's G6 had.
 ## Engineering Skills
-Shared engineering skills live in the **`mathias/skills`** repo (`git.d-ma.be/mathias/skills`). Load at task start — not "on demand" but on schedule, before writing code. Browse `SKILLS_INDEX.md` for the full list.
+Shared engineering skills live in the **`mathias/skills`** repo (`git.d-ma.be/mathias/skills`). Clone it to `~/dev/skills/` and run `SKILLS_CHECKOUT_DIR="$PWD" bash install.sh` there to wire every skill into your harnesses (Claude Code, Crush, Antigravity, Mistral Vibe) as native, on-demand skills. (Use `install.sh`, not `task install` — the latter is currently broken, skills#7.) Load at task start — not "on demand" but on schedule, before writing code. Browse `~/dev/skills/SKILLS_INDEX.md` for the full list.
 **Claude Code** installs the repo as a plugin from the marketplace the same repo hosts. That path also carries the `secret-guard` and `pre-task-ritual` hooks and the brain/gitea/infra MCP servers, which symlinks cannot:
 ```
 /plugin marketplace add https://git.d-ma.be/mathias/skills.git
 /plugin install skills@mathias
 ```
 Skills are **namespaced** under Claude Code: load `tdd` as `skills:tdd`. The trigger table below uses bare names — prefix them.
 **Crush, Pi and OpenCode** have no plugin system and are wired by `install.sh` as one directory symlink per harness via `~/.agents/skills`. Do not clone the checkout into `~/dev`: that folder is iCloud-shared between the Macs and spans two path roots (`/Users/mathias` vs `/home/mathias` on koala), so a checkout there is a git working tree with two concurrent writers, and any absolute symlink stored in it is broken on one side by construction (skills#23). Leave `SKILLS_CHECKOUT_DIR` at its host-local default.
 Check a host with `task doctor` in the skills repo; it also runs automatically at session start via the plugin.
 **Skill trigger table — load before starting, not after getting stuck:**
@@ -493,11 +353,7 @@ the routing pod; brain tools moved to the brain MCP.
 The brain HTTP REST API (`/query`, `/write`, `/ingest`, `/ingest-raw`,
 `/ingest-path`, `/backfill-refs`, `/pass-rate`) remains available on port 3300
-for shell scripts and non-MCP clients, **with the same bearer token as `/mcp`**
+for shell scripts and non-MCP clients.
 (`BRAIN_MCP_TOKEN`; hyperguild#149). It is not served on the public host
 (infra#517): use the tailnet (`koala:8443`) or in-cluster
 `ingestion.supervisor.svc:3300`. `/ingest-path` and `brain_ingest` `path`
 accept only paths inside `brain/raw/`.
 `brain_answer(query)` performs BM25 retrieval + LLM synthesis (berget.ai
 gemma4:31b → iguana fallback). `brain_classify(text)` infers doc type, title,
@@ -1,2 +0,0 @@
 # Presence of this file marks this repo as opt-in for headless dispatch.
 # See dispatch#3.
@@ -1,6 +1,7 @@
 # Supervisor MCP server
 SUPERVISOR_PORT=3200
 SUPERVISOR_CONFIG_DIR=./config/supervisor
 SUPERVISOR_MODELS_FILE=./config/models.yaml
 # LiteLLM gateway (iguana)
 LITELLM_BASE_URL=http://iguana:4000
@@ -45,12 +45,6 @@ jobs:
          set -e
          trap 'rm -rf /tmp/infra-update; rm -f ~/.ssh/infra_deploy_key' EXIT
          IMAGE_TAG="${{ github.sha }}"
          # infra#311: github.sha is never empty in practice, but the manifest
          # patch below is the same shape that took Flux down estate-wide on
          # 2026-08-25 -- an empty tag yields `image: <repo>:`, which is invalid
          # YAML and fails the ENTIRE Kustomization, not just this app. The
          # assert costs nothing and removes the class.
          [ -n "${IMAGE_TAG:-}" ] || { echo "IMAGE_TAG is empty - refusing to patch"; exit 1; }
          mkdir -p ~/.ssh
          echo "${{ secrets.INFRA_DEPLOY_KEY }}" > ~/.ssh/infra_deploy_key
          chmod 600 ~/.ssh/infra_deploy_key
@@ -81,19 +75,11 @@ jobs:
          git config user.email "cd-bot@d-ma.be"
          git config user.name "CD Bot"
          git add "k3s/apps/supervisor/ingestion-deployment.yaml"
          # Idempotent: `git commit` exits 1 on an empty index, so a run that
          # finds the bump already applied failed the whole job and rang the
          # CI-red alarm for a deploy that was fine (hyperguild#118). Two
          # sources of a no-op run: a manual re-run, and the tag-push CI run
          # that used to shadow the branch-push one for the same sha.
          if git diff --cached --quiet; then
            echo "Infra already at ${IMAGE_TAG} — nothing to commit"
          else
          git commit -m "chore(deploy): ingestion → ${IMAGE_TAG}"
          GIT_SSH_COMMAND="ssh -i ~/.ssh/infra_deploy_key -o IdentitiesOnly=yes" \
            git push
          echo "Infra repo updated: ingestion → ${IMAGE_TAG}"
          fi
      - name: Trigger Flux reconcile (immediate)
        run: |
@@ -2,13 +2,8 @@ name: CI
 "on":
  push:
    # Branch only. A `v*` tag here points at a commit main already tested, so
    # the tag push re-ran the whole gate and — because cd.yml keys off "CI
    # succeeded" — triggered a SECOND full image build and deploy for the same
    # sha. That second deploy then died on "nothing to commit" (hyperguild#118).
    # Nothing consumes a tag-triggered run: there is no release workflow, and
    # cd.yml reads github.sha, not the tag.
    branches: [main]
    tags: ["v*"]
  pull_request:
    branches: [main]
@@ -1,34 +0,0 @@
 #!/usr/bin/env bash
 # Pre-commit secret scan for the hyperguild repo.
 #
 # task check -> security:gitleaks enforces this in CI, but CI is after the
 # push. This catches a staged secret before it ever leaves the machine --
 # the infra#39 rotation pass found exactly this class of leak (a printed
 # credential, committed, archived into git) and there was no local gate to
 # have caught it. Mirrors infra's own .githooks/pre-commit (infra#326).
 #
 # Enable once per clone:   git config core.hooksPath .githooks
 # Bypass if absolutely needed: git commit --no-verify
 set -euo pipefail
 GITLEAKS="$(command -v gitleaks || true)"
 if [[ -z "$GITLEAKS" && -x "$(go env GOPATH 2>/dev/null)/bin/gitleaks" ]]; then
  GITLEAKS="$(go env GOPATH)/bin/gitleaks"
 fi
 if [[ -z "$GITLEAKS" ]]; then
  echo "⚠ gitleaks not installed — skipping local secret scan (CI still enforces it)."
  echo "  Install: go install github.com/zricethezav/gitleaks/v8@latest"
  exit 0
 fi
 echo "→ Scanning staged changes for secrets..."
 if ! "$GITLEAKS" protect --staged --redact --config .gitleaks.toml >/dev/null 2>&1; then
  echo "  ✗ gitleaks found a secret in the staged changes."
  echo "    Review with: gitleaks protect --staged --redact --config .gitleaks.toml -v"
  echo "    If it is a false positive, allowlist it in .gitleaks.toml or add a"
  echo "    '# gitleaks:allow' comment. Do NOT --no-verify a real secret."
  exit 1
 fi
 echo "  ✓ no staged secrets"
@@ -56,16 +56,8 @@ paths = [
  '''ingestion/internal/claudewatcher/watcher_test\.go$''',
 ]
-# infra#344: the allowlist that used to sit here is gone, and so is the reason
+[[allowlists]]
-# for it. It suppressed docs/superpowers/plans/2026-04-22-phase4-attempt-wiring.md
+description = "Literal placeholder word REDACTED matched as if it were a token (verified 2026-08-04: extracted Secret == 'REDACTED' exactly, gitleaks' curl-auth-header rule matched the placeholder text itself, not a real credential)"
-# on the stated grounds that "extracted Secret == 'REDACTED' exactly ... the
+condition = "AND"
-# placeholder text itself, not a real credential" (verified 2026-08-04). That was
+paths = ['''docs/superpowers/plans/2026-04-22-phase4-attempt-wiring\.md$''']
-# not what the file contained: line 1054 carried a real 40-char hex Gitea PAT in
+regexes = ['''REDACTED''']
 # an `Authorization: token ...` header. Confirmed dead by side-effect — GET
 # /api/v1/user with it returns 401 — and redacted in that file, so there is now
 # nothing to allowlist.
 #
 # The `paths` entry also made the block far broader than its description: gitleaks
 # ORs global allowlist clauses and ignores `condition = "AND"`, so the whole file
 # was immune, not just lines matching /REDACTED/. A live token added to that doc
 # would have been suppressed on the strength of a note about a different value.
@@ -1,33 +0,0 @@
 # Historical gitleaks findings, dispositioned (infra#326 / infra#317).
 #
 # WHY THIS FILE AND NOT .gitleaks.toml:
 # This is a finding in git HISTORY, surfaced by the full-history audit
 # (`task security:gitleaks:history`). The working-tree scan that gates commits
 # (`task security:gitleaks`, the pre-commit hook, CI) is clean. Suppressing by
 # PATH in .gitleaks.toml would also blind the working-tree scan for that file
 # forever; a fingerprint pins one finding in one commit, so a NEW secret in the
 # same file still fires.
 #
 # History is not rewritten here, so the remediation for a real leak is
 # ROTATION -- making the committed value worthless -- never scrubbing.
 #
 # Dispositioned 2026-08-29. Re-check with: task security:gitleaks:history
 # --- Real credential, ALREADY DEAD -------------------------------------------
 # A Gitea PAT pasted into a CD-watching command in a planning doc
 # (`Authorization: token <40-hex>`, last_eight 3105a670).
 #
 # Verified dead 2026-08-29: authenticating against
 # GET https://git.d-ma.be/api/v1/user with this exact value returns 401, so the
 # committed token no longer grants anything. It was almost certainly invalidated
 # by the early-August rotation of the `mathias` PATs (the same rotation whose
 # fan-out caused infra#260, where CI copies of the old value kept failing).
 #
 # No rotation action outstanding. Kept as a fingerprint rather than removed from
 # history because history cannot be rewritten here.
 #
 # The generalisable lesson is recorded separately: a credential printed into a
 # doc/transcript is permanent, so the only remedy is rotating it -- which in
 # this case had already happened for unrelated reasons, by luck rather than by
 # the leak being noticed.
 c9310b1079478bf4430b0a2dfb25445d7ccc9b59:docs/superpowers/plans/2026-04-22-phase4-attempt-wiring.md:curl-auth-header:1053
@@ -48,51 +48,14 @@ These rules apply to every task across every project, regardless of harness.
   logical change (one tool, one fix, one test) with passing tests. Main is always
   deployable. Never create long-lived feature branches.
-   **The PR trigger is RISK, not concurrency.** `risk/low` work commits straight to
+   **Exception — parallel agents on same repo:** If another agent is known to be
-   main with CI as the gate — that is most work and is unchanged. `risk/medium` and
+   actively working on the same repo simultaneously, create a short-lived branch
-   above opens a PR, even solo, even with nobody waiting to review it. This mirrors
+   (`agent/<description>`), finish the task, and merge to main within the same
-   the tiered merge model in `assessor-loop`
+   session. Do not leave agent branches open between sessions.
   `method/transfer-to-a-regulated-organisation.md` §4.1, so the estate practises
   what it sells instead of merging everything on green and claiming otherwise.
-   **Concurrency is NOT a reason to branch.** Measured 2026-08-29 across three real
+   **Exception — external contributor or client four-eyes requirement:** Use
-   collisions between parallel sessions: two were not branching problems at all — a
+   PR flow only when a human reviewer outside the project is required. Document
-   generated artifact written to the same path by both (branching turns that into a
+   the reason in PROJECT.md.
   merge conflict on a 33k-line JSON), and uncommitted work in a shared checkout
   (a per-session worktree fixes it) — and the third was an ordinary non-fast-forward
   push resolved by rebase in seconds. Use a worktree per session on shared repos and
   timestamp generated artifacts. Do not reach for a branch.
   Branch+PR flow carries documented costs on solo repos: merging auto-closes gated
   issues, review comments live on a thread separate from the issue's, and a
   merged-and-deleted branch cannot be amended (brain:
   `gitea-pr-merge-autoclose-and-review-comment-footguns`). Those are the price of
   the `risk/medium`+ lane — paid deliberately, not incurred by accident.
   **Exception — external contributor or client four-eyes requirement:** Use PR flow
   when a human reviewer outside the project is required. Document the reason in
   PROJECT.md.
   **Exception — a GitOps repo where a branch cannot be reconciled.** In a repo whose
   deployment watches one branch (`mathias/infra`: Flux watches `main`), a branch is
   invisible to the thing that applies it. A `risk/medium` change to `alerts.yaml` or
   `litellm-config.yaml` can be linted on a branch but never *exercised* there, so a
   PR would buy a review of a state that was never deployed.
   There, `risk/medium`+ work stays on `main` and instead requires a **recorded
   adversarial review pass before the push** — `skills:pr-gatekeeper` or equivalent,
   reviewing the staged diff. **The reviewer's verdict goes in the issue, not a PR
   thread.** No verdict recorded means the lane was not used, and saying "the gate was
   green" is not the same claim.
   Be honest about what this is: a recorded *independent* pass, not four-eyes in the
   sense `assessor-loop` §4.1 means for a regulated organisation, because the reviewer
   is an agent. It is more than the repo had and less than the model it mirrors; do not
   describe it as the stronger property. (infra#470, decided 2026-09-29.)
   This lane depends on the `risk/` label being right. A label that triggers a heavier
   lane is load-bearing, not cosmetic — if work that belongs in it is unlabelled, the
   lane silently does not apply.
 6. **Close the loop — every substantive task ends with the same ritual.** Shipping
   the code is not the end of the task; capturing it is. Run this unprompted:
@@ -110,63 +73,6 @@ These rules apply to every task across every project, regardless of harness.
   - Surface the brain entries and issue numbers in the closing summary so the
     trail is auditable.
   **Chat is not a durable store. Never rely on Mathias remembering anything.**
   Every gap, caveat, risk, open question and next step must land in one of four
   places before the turn ends: **the brain**, **a repo** (code, docs, ADR),
   **a tracker issue**, or **a plan file**. A finding stated only in conversation is
   lost the moment the session closes — and this estate has repeatedly proved that a
   remembered convention is an unreliable control.
   This applies hardest to what is tempting to leave as a closing remark: "worth
   knowing X isn't enforced yet", "this is a convention, not a gate", "we should
   revisit Y". Those are exactly the items that need a locator. If it is worth
   saying in a summary, it is worth writing where it can be found again without you.
 7. **Finish what's closable — only involve me for a genuine call.** If a
   tracker issue, PR, or checklist item is demonstrably resolved — the fix
   landed, the state changed, you verified it live — close/merge/check it off
   in the same turn. Don't leave it open "for the record" or park it waiting
   on me to confirm something that already happened; that's bookkeeping, not
   a decision. Reserve asking me (`AskUserQuestion`, a `DECISION NEEDED`
   comment, or otherwise pausing) for when it's genuinely mine to call:
   irreversible or prod/host-impacting actions, a real judgment call with no
   clearly-better option, ambiguous intent, or anything secret-writes/
   destructive-git already gate. Before claiming something is closable,
   verify it live (re-check the issue, re-run the command) rather than
   trusting your own earlier summary (brain: `filed-issue-not-same-as-fixed`).
 8. **Control code needs an adversary, not a checklist.** Code whose job is to
   refuse, deny, gate or contain is not adequately verified by a green gate.
   Rule 5 makes CI the quality gate and that holds for ordinary work — but a
   passing suite only asserts what its author already thought of, and for a
   control the author is precisely the person whose imagination just failed.
   Measured on `dispatch#75`: five review rounds, five real escapes verified by
   execution, and **CI was green on every one of them** while `git rm
   ././.dispatch-allow` deleted the file the control existed to protect. So
   route this work through a review with authority to block, instructed to
   verify by execution rather than by reading the implementation. Expect to be
   blocked more than once; that is the control working, not the reviewer being
   difficult. (brain: `a-green-gate-is-not-evidence-for-control-code`; the
   practices live in the `pr-gatekeeper` agent.)
 9. **A test's name must not claim more than its assertions prove.** Name a test
   after the mechanism it observes, not the goal it serves.
   `DoesNotInheritEnv` is honest; `IsContained` is a claim the test cannot
   support. This is not pedantry about naming — when name and assertion
   diverge, the name wins in the reader's head and the gap becomes invisible,
   which is what lets the defect survive review. Found three times in one PR,
   twice in tests written to fix the previous instance of it; each passed while
   the thing it was named for was exploitable. If you cannot name the mechanism,
   you do not yet know what the test observes.
 ## CAD sprint patterns
 Two CAD sprint archetypes (defs: brain `wiki/homelab/decisions/continuous-agentic-development-cad-concept-2026-06-16`):
 - **Inception Sprint** — birth a new repo. Oath-gated close; tag only once every clause holds. Brain: `.../inception-sprint-and-oath`.
 - **Sweep Sprint** — clear an existing backlog. Parallel read-only research per issue → sequential one-issue-per-commit execution. Brain: `.../sweep-sprint-and-oath`.
 Shared: decisions that are yours, not the agent's, surface as `DECISION NEEDED` (question/options/recommendation/blocks) — ask live if you're present, else comment and wait, never act past it. Live-breaking regressions get `git revert`, never forward-fixed; host-network work skips even read-only research (solo, synchronous, you present). Rule 6's closing ritual only fires once every Oath clause genuinely holds — blocked = descoped-and-tracked, never marked done.
 ## Default stack
 | Layer | Default | Fallback | Last resort |
@@ -229,10 +135,10 @@ Three machines on Tailscale:
 |---------|------|-----------|
 | koala | GPU inference, heavy compute | RTX 5070, runs k3s + llama-swap + shared postgres18/pgvector |
 | iguana | Services, builds | M2 Ultra Mac |
-| flamingo | Daily driver, edge | Apple Silicon Mac, ~/dev is here |
+| flamingo | Daily driver, edge | Mac mini, ~/dev is here |
 - **Model routing**: LiteLLM in front of llama-swap (local) + cloud APIs (when permitted)
- **Orchestration**: k3s on koala only — single control-plane node, no workers (verified 2026-08-30). iguana and flamingo are on the tailnet but are not cluster members
+- **Orchestration**: k3s cluster across all three machines
 - **Networking**: Tailscale mesh
 ## Project landscape
@@ -299,16 +205,10 @@ entries that age well are about *why*, *how to avoid*, and *what to do when*.
 |---------|-------|-------|
 | **Claude Code, Claude Desktop** | `brain_query` (BM25), `brain_answer` (LLM-synth + sources) MCP tools | `brain_write` MCP tool |
 | **Crush, Pi, Antigravity, other MCP-capable** | same MCP server: `ingestion-brain` (via the `mcp__*_brain__*` namespace once authenticated) | same |
-| **Anything HTTP-only (curl, scripts)** | Tailnet only: `POST https://koala.tail30472e.ts.net:8443/query` with `{"query":"..."}`, sending `BRAIN_MCP_TOKEN` (not yet enforced on REST, hyperguild#149). The public `brain-mcp.d-ma.be` serves `/mcp` only (infra#517). | `POST .../write` with `{"content":"...","wing":"...","hall":"..."}` |
+| **Anything HTTP-only (curl, scripts)** | `POST https://brain-mcp.d-ma.be/query` with `{"query":"..."}` (auth via `BRAIN_MCP_TOKEN`) | `POST .../write` with `{"content":"...","filename":"..."}` |
 | **Browser / human inspection** | `https://git.d-ma.be/mathias/hyperguild` → `knowledge/` and `wiki/` markdown files |
- **Scoping — the brain holds no confidential client content.** Nothing on the read path
+- **Scoping**: defaults to `public` collection; client projects filter to `{client}` + `public`.
  filters by client: every token holder can read every wing, and `wing` on `brain_query`
  is an optional argument, not an access control. Client confidentiality is enforced only
  at write time (`capture`'s I1 gate refuses internal/confidential). So never `brain_write`
  client material; generalise it first or keep it in the client's own repo. (hyperguild#144,
  decided 2026-10-01. This line previously claimed client projects were filtered; they
  were not.)
 - **Routing**: brain_answer's LLM uses berget.ai as primary, iguana ollama as
  fallback. Both are configurable in the `supervisor/ingestion-deployment.yaml`
  on the koala k3s cluster; don't hardcode local-only model names into the
@@ -334,11 +234,10 @@ When working on a project tagged with a client name:
 ## Harness-agnostic principles
-Supported harnesses (2026-09-01) — Cursor and Aider were dropped; do not
+This context is designed to work with any AI coding tool:
-re-add adapters for them:
+- Claude Code, Cursor, Aider, Open WebUI, Charmbracelet Mods/Crush
- Claude Code, Antigravity, OpenCode, Mistral Vibe, Crush, Pi Coding Agent
+- Pi Coding Agent, Mistral Vibe, Antigravity
- Open WebUI, Charmbracelet Mods, or any tool that takes a system prompt string
+- Any tool that accepts a system prompt or reads a markdown context file
 - Any other tool that reads `AGENTS.md`, which is the de facto convention
 The canonical source is always `.context/AGENT.md` (root) and `.context/PROJECT.md` (per-project).
 Derived files are committed (see *How context propagates* below) so a `git pull` on any host yields full agent context with no setup.
@@ -350,65 +249,26 @@ Canonical sources of truth:
 - Project: `<repo>/.context/PROJECT.md` (per-repo)
 Derived files (committed, regenerated by `task context:sync`):
- `CLAUDE.md`, `AGENTS.md`, `.context/system-prompt.txt`
+- `CLAUDE.md`, `AGENTS.md`, `.cursorrules`, `.aider.conventions.md`,
-
+  `.context/system-prompt.txt`
 Repos still carrying `.cursorrules`, `.aider.conventions.md` or
 `.aider.conf.yml` are stale: nothing regenerates them. Delete them the next time
 you touch the repo, along with their entries in that repo's `task check`
 assertion.
 Workflow:
 1. Edit a canonical file. Run `task context:sync`. Commit canonical and
   derived together. Push.
-2. On any other host, `git pull` brings both. Which file a harness reads does
+2. On any other host, `git pull` brings both. Claude Code (tree-walking)
-   NOT split cleanly by lookup strategy, so do not reason from the strategy:
+   uses `CLAUDE.md`; Crush / Pi / Antigravity (cwd-only) use `AGENTS.md`;
-   - `CLAUDE.md` — Claude Code (walks up the tree)
+   Cursor uses `.cursorrules`; Aider uses `.aider.conventions.md`.
   - `AGENTS.md` — Crush, Pi, Antigravity (cwd-only), OpenCode (project root,
     global at `~/.config/opencode/AGENTS.md`), and Mistral Vibe, which **walks
     up** from cwd and takes the first `AGENTS.md` it finds
     (user-level `~/.vibe/AGENTS.md`)
   - `.context/system-prompt.txt` — Open WebUI, Mods, raw API calls; not read by
     any harness, it is for pasting
   Vibe tree-walks for `AGENTS.md`, so "tree-walkers use CLAUDE.md" is false.
   Each repo's `AGENTS.md` embeds the canonical and is the first one found from
   inside that repo, so this works — but by construction, not by luck.
 3. `task check` runs `context:sync` then asserts `git status --porcelain`
   is empty over the derived files (catches both modified-tracked drift
   and missing-untracked adapters). A drift fails the check with a
   message telling you to stage the regenerated files.
-Behavior rules in this file and per-project rules in `PROJECT.md` apply on every
+Behavior rules in this file and per-project rules in `PROJECT.md` apply
-host and every harness.
+unconditionally on every host, every harness.
 **Where a project rule contradicts a rule here, the project rule governs — and it
 must state its reason.** Both halves matter: the project file wins because it knows
 something this file cannot (infra's Flux constraint is real and not visible from
 here), and it must say why because a bare override is indistinguishable from drift.
 This replaces the previous wording, which said rules here and in `PROJECT.md` both
 apply *"unconditionally"*. That was not a tiebreak but a contradiction, and it went
 unnoticed until rule 5 and infra's "never create feature branches" had to be obeyed
 at the same time (infra#470). A standard can hold two individually sensible clauses
 that are jointly unsatisfiable, and survive for as long as everyone reads it
 charitably — the same failure the Inception Sprint Oath's G6 had.
 ## Engineering Skills
-Shared engineering skills live in the **`mathias/skills`** repo (`git.d-ma.be/mathias/skills`). Load at task start — not "on demand" but on schedule, before writing code. Browse `SKILLS_INDEX.md` for the full list.
+Shared engineering skills live in the **`mathias/skills`** repo (`git.d-ma.be/mathias/skills`). Clone it to `~/dev/skills/` and run `SKILLS_CHECKOUT_DIR="$PWD" bash install.sh` there to wire every skill into your harnesses (Claude Code, Crush, Antigravity, Mistral Vibe) as native, on-demand skills. (Use `install.sh`, not `task install` — the latter is currently broken, skills#7.) Load at task start — not "on demand" but on schedule, before writing code. Browse `~/dev/skills/SKILLS_INDEX.md` for the full list.
 **Claude Code** installs the repo as a plugin from the marketplace the same repo hosts. That path also carries the `secret-guard` and `pre-task-ritual` hooks and the brain/gitea/infra MCP servers, which symlinks cannot:
 ```
 /plugin marketplace add https://git.d-ma.be/mathias/skills.git
 /plugin install skills@mathias
 ```
 Skills are **namespaced** under Claude Code: load `tdd` as `skills:tdd`. The trigger table below uses bare names — prefix them.
 **Crush, Pi and OpenCode** have no plugin system and are wired by `install.sh` as one directory symlink per harness via `~/.agents/skills`. Do not clone the checkout into `~/dev`: that folder is iCloud-shared between the Macs and spans two path roots (`/Users/mathias` vs `/home/mathias` on koala), so a checkout there is a git working tree with two concurrent writers, and any absolute symlink stored in it is broken on one side by construction (skills#23). Leave `SKILLS_CHECKOUT_DIR` at its host-local default.
 Check a host with `task doctor` in the skills repo; it also runs automatically at session start via the plugin.
 **Skill trigger table — load before starting, not after getting stuck:**
@@ -488,11 +348,7 @@ the routing pod; brain tools moved to the brain MCP.
 The brain HTTP REST API (`/query`, `/write`, `/ingest`, `/ingest-raw`,
 `/ingest-path`, `/backfill-refs`, `/pass-rate`) remains available on port 3300
-for shell scripts and non-MCP clients, **with the same bearer token as `/mcp`**
+for shell scripts and non-MCP clients.
 (`BRAIN_MCP_TOKEN`; hyperguild#149). It is not served on the public host
 (infra#517): use the tailnet (`koala:8443`) or in-cluster
 `ingestion.supervisor.svc:3300`. `/ingest-path` and `brain_ingest` `path`
 accept only paths inside `brain/raw/`.
 `brain_answer(query)` performs BM25 retrieval + LLM synthesis (berget.ai
 gemma4:31b → iguana fallback). `brain_classify(text)` infers doc type, title,
@@ -64,11 +64,7 @@ the routing pod; brain tools moved to the brain MCP.
 The brain HTTP REST API (`/query`, `/write`, `/ingest`, `/ingest-raw`,
 `/ingest-path`, `/backfill-refs`, `/pass-rate`) remains available on port 3300
-for shell scripts and non-MCP clients, **with the same bearer token as `/mcp`**
+for shell scripts and non-MCP clients.
 (`BRAIN_MCP_TOKEN`; hyperguild#149). It is not served on the public host
 (infra#517): use the tailnet (`koala:8443`) or in-cluster
 `ingestion.supervisor.svc:3300`. `/ingest-path` and `brain_ingest` `path`
 accept only paths inside `brain/raw/`.
 `brain_answer(query)` performs BM25 retrieval + LLM synthesis (berget.ai
 gemma4:31b → iguana fallback). `brain_classify(text)` infers doc type, title,
@@ -1 +1,2 @@
 ingestion: cd ingestion && INGEST_BRAIN_DIR=../brain INGEST_PORT=3300 INGEST_WATCH_INTERVAL=30 go run ./cmd/server/
 supervisor: SUPERVISOR_CONFIG_DIR=./config/supervisor SUPERVISOR_MODELS_FILE=./config/models.yaml SUPERVISOR_SESSIONS_DIR=./brain/sessions INGEST_BASE_URL=http://localhost:3300 INGEST_SVC_URL=http://localhost:3300 go run ./cmd/supervisor/
@@ -5,11 +5,6 @@ Instead of letting Claude Code do whatever it wants, hyperguild enforces structu
 workflows (TDD red/green/refactor), logs every session, and accumulates learnings
 into a searchable brain.
 **This repo is also where `brain-mcp` lives** — the MCP server at
 `brain-mcp.d-ma.be` that `brain_query`, `brain_write`, `brain_read`, `brain_edit`
 and `capture` are served from. It is not a separate deployable; see
 [Where brain-mcp lives](#where-brain-mcp-lives).
 ## Hypothesis
 > We believe routing skill tasks through local models, backed by brain context,
@@ -25,7 +20,7 @@ usage, the fast-model routing path should be reconsidered.
 **hyperguild = Claude Code + MCP.** This is a supervisor for Claude Code sessions specifically.
 For multi-agent orchestration (OpenCode + LiteLLM, executor/reviewer pipelines), see
-[agentsquad](https://git.d-ma.be/mathias/agentsquad) — a separate harness for a different
+[agentsquad](http://gitea.d-ma.be/mathias/agentsquad) — a separate harness for a different
 orchestration model. Skills (mathias/skills) are shared between both.
 ## How it works
@@ -49,91 +44,6 @@ brain/
 └── knowledge/      — legacy flat notes (migration pending: hyperguild#22)
 ```
 ## Where brain-mcp lives
 `brain-mcp` is served from **`ingestion/internal/mcp`** in this repo, at
 **`brain-mcp.d-ma.be`**. It is a component *inside* the `ingestion` service, not
 a standalone deployable — one pod in the `supervisor` namespace serves the MCP
 endpoint, the REST API, and the claudewatcher together.
 | You are looking for | It is here |
 |---|---|
 | The MCP tool surface (`brain_query`, `brain_write`, `brain_read`, `brain_edit`, `capture`, …) | `ingestion/internal/mcp` |
 | The HTTP/REST API (`/query`, `/write`, `/ingest`) | `ingestion/internal/api` |
 | Session ingestion from Claude Code transcripts | `ingestion/internal/claudewatcher` |
 | The brain *content* (notes, wings, halls) | [`mathias/brain`](https://git.d-ma.be/mathias/brain) — a separate repo |
 | Deployment manifests | `config/supervisor` |
 ### Why it is not its own repo
 Asked and decided in [#91](https://git.d-ma.be/mathias/hyperguild/issues/91)
 (part 2). `internal/mcp` imports 17 of ingestion's other internal packages and
 has exactly one importer — it is the MCP facade over the service's own
 internals, so "move it out" resolves to renaming `ingestion`, publishing 17
 packages as a shared library, or maintaining a shim. The discoverability problem
 that prompted the question is answered by naming it here instead.
 Full reasoning, including the reversal trigger: brain
 `wiki/hyperguild/decisions/brain-mcp-stays-in-ingestion-fix-discoverability-by-name`.
 ## Ingest revises, it does not overwrite
 Re-ingesting a source **merges into the page already on disk** rather than
 replacing it. Previously the write was unconditional, so a second ingest of the
 same source discarded everything accumulated since — including hand-written
 sections.
 The merge is deliberately asymmetric in the existing page's favour:
 | On the page | In the fresh extraction | Result |
 |---|---|---|
 | a section | the same section | **the on-disk version wins** |
 | — | a new section | added |
 | a bullet list (`Sources`, `Key Claims`, …) | more bullets | unioned, no duplicates |
 | an append section (`Open Questions`, `Updates`, …) | more lines | only genuinely new lines appended |
 | frontmatter | frontmatter | **the on-disk frontmatter wins** |
 So an extraction can add to a note but never silently rewrite what a human put
 there, which is what makes it safe to run on every ingest rather than behind a
 review gate.
 Re-ingesting unchanged content is **byte-identical** — no diff, so brain-sync
 does not commit noise that hides real edits.
 Two fields are **generator-owned** and do get refreshed on a revise:
 `last_updated` and `source_hash`. Everything else on disk wins. The boundary is
 an explicit allowlist, so a field nobody has thought about stays human-owned.
 ### Disagreement is reported, not resolved
 When the fresh extraction produces a *different version* of a section that
 already exists, the on-disk version still wins — but the run now says so:
 ```
 wiki/sources/shape-up.md: source now disagrees on section "Summary" — on-disk version kept
 ```
 That line lands in `log.md` with the rest of the run's warnings. Without it, "the
 source is unchanged" and "the source changed its mind and we ignored it" look
 identical from the outside.
 This is deliberately **textual** disagreement, not semantic contradiction: cheap,
 deterministic, no model on the write path. Deciding whether a disagreement is a
 genuine contradiction stays with the Judge-gated `brain-enrich` pass, which is
 approval-gated by design. Detection here, adjudication there.
 ## Re-ingesting an unchanged source is skipped
 Ingest stores `source_hash` — sha256 of the ingested **body**, frontmatter
 excluded — on the source page. A later ingest of the same source compares it
 first and skips extraction entirely when it matches, reporting the skip rather
 than doing it silently.
 Body-only is deliberate: a re-crawl that stamps a new fetch date has not changed
 the source, and treating that as drift would re-extract the corpus every time a
 crawler ran. A missing or unreadable hash always means "extract" — a missed skip
 costs one extraction, a wrong skip loses an update.
 ## Phase 1 tools (available now)
 | Tool | What it does |
@@ -148,7 +58,7 @@ costs one extraction, a wrong skip loses an update.
 | `tier` | Returns the current connectivity tier (1=cloud, 2=LAN, 3=offline) |
 > **Note:** `tdd_red/green/refactor` and `spec` were retired in Plan 7 (2026-05-12).
-> They are now SKILL.md files in [mathias/skills](https://git.d-ma.be/mathias/skills).
+> They are now SKILL.md files in [mathias/skills](http://gitea.d-ma.be/mathias/skills).
 ## Connect a project
@@ -237,7 +147,7 @@ The routing pod selects models per skill call based on historical pass rate:
 ## Open issues
-See [issues](https://git.d-ma.be/mathias/hyperguild/issues) — key open items:
+See [issues](http://gitea.d-ma.be/mathias/hyperguild/issues) — key open items:
 - **#25** — skills platform overhaul (audit first, then lazy loading + brain feedback loop)
 - **#24** — reduce context burn from skill listing
@@ -21,7 +21,7 @@ tasks:
  # ── Development ────────────────────────────────────────────────────────────
  start:
-    desc: Start ingestion (requires goreman — go install github.com/mattn/goreman@latest)
+    desc: Start ingestion + supervisor (requires goreman — go install github.com/mattn/goreman@latest)
    cmds:
      - goreman start
@@ -32,6 +32,11 @@ tasks:
      - lsof -ti:3200 | xargs kill -9 2>/dev/null || true
      - echo "hyperguild stopped"
  supervisor:dev:
    desc: Run supervisor MCP server (development)
    cmds:
      - go run ./cmd/supervisor
  hyperguild:dev:
    desc: Run hyperguild CLI from source (e.g. task hyperguild:dev -- tier)
    cmds:
@@ -62,9 +67,14 @@ tasks:
  build:
    desc: Build all binaries
    cmds:
-      - task: hyperguild:build
+      - task: supervisor:build
      - task: ingestion:build
  supervisor:build:
    desc: Build supervisor binary
    cmds:
      - go build -trimpath -ldflags="-s -w -X main.version={{.VERSION}}" -o bin/supervisor ./cmd/supervisor
  ingestion:build:
    desc: Build ingestion server binary
    dir: ingestion
@@ -74,28 +84,10 @@ tasks:
  # ── Quality ────────────────────────────────────────────────────────────────
  check:
-    desc: Run all checks (context freshness + lint + test + vet + build) across all modules
+    desc: Run all checks (context freshness + lint + test + vet) across all modules
    cmds:
-      # Context sync is skipped under CI, matching dma-cli, gitea-mcp, and the
+      - task: context:sync
      # rest of the estate. It is not a preference: context-sync.sh walks UP
      # the tree for the canonical .context/AGENT.md, which lives in local-dev
      # and does not exist on a CI runner. Without this guard, the script
      # silently falls back to "project context only" and regenerates AGENTS.md
      # and .context/system-prompt.txt shorter than their committed, correct
      # versions -- so the drift assertion fails every CI run for a purely
      # environmental reason, not real drift. Verified, not assumed: this is
      # exactly what was happening here (AGENTS.md 430 lines committed vs. an
      # 82-line regeneration on the runner).
      #
      # The cost is real and worth stating: drift is therefore only ever caught
      # on a developer machine, or by infra's estate-wide context-sync-drift
      # CronJob (ADR-0019), which does have canonical access and is the actual
      # enforcement mechanism now.
      - cmd: |
          if [ -n "${CI:-}" ]; then
            echo "✓ context sync: skipped in CI (no canonical AGENT.md on the runner)"
          else
            bash scripts/context-sync.sh
          drift=$(git status --porcelain -- AGENTS.md CLAUDE.md .context/system-prompt.txt 2>/dev/null)
          if [ -n "$drift" ]; then
            echo "ERROR: derived adapters drifted from canonical context." >&2
@@ -106,16 +98,9 @@ tasks:
            exit 1
          fi
          echo "✓ context: canonical and adapters are in sync"
          fi
      - task: lint
      - task: test
      - task: vet
      # `build` is in the gate deliberately (hyperguild#120). vet and test walk
      # ./... , which enumerates the packages that EXIST — so a build target
      # naming a DELETED package is invisible to both. `task build` pointed at
      # ./cmd/supervisor for months after that directory was removed, and CI
      # stayed green the whole time because nothing in check ever built.
      - task: build
      - task: security:gitleaks
  # ── Security ─────────────────────────────────────────────
@@ -153,11 +138,6 @@ tasks:
      - golangci-lint run ./...
      - cd ingestion && golangci-lint run ./...
  lint:frontmatter:
    desc: Report brain notes whose YAML frontmatter does not parse (BRAIN=path, FIX=1 repairs in place)
    cmds:
      - cd ingestion && go run ./cmd/frontmatterlint {{if .FIX}}-fix{{end}} {{.BRAIN | default "../../brain"}}
  test:
    cmds:
      - go test -race -count=1 ./...
@@ -169,6 +149,19 @@ tasks:
      - govulncheck ./... || true
      - cd ingestion && go vet ./...
  supervisor:test:smoke:
    desc: Smoke test supervisor via MCP (requires start running)
    cmds:
      - |
        curl -s -X POST http://localhost:${SUPERVISOR_PORT:-3200}/mcp \
          -H "Content-Type: application/json" \
          -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' | jq .
  smoke:routing:
    desc: Boot the routing pod against live LiteLLM + brain and verify _routing logs land
    cmds:
      - bash scripts/smoke-routing.sh
  # ── Git / Release ──────────────────────────────────────────────────────────
  tag:
@@ -55,21 +55,18 @@ Flags:
 - `--limit N` — max results (default 5)
 - `--json` — emit the raw response envelope
-### `hyperguild brain write <wing> <hall> <slug>`
+### `hyperguild brain write <type> <slug>`
-Reads markdown from stdin, writes it to `brain/wiki/<wing>/<hall>/<slug>.md`
+Reads markdown from stdin, writes a knowledge entry.
 with `wing`/`hall`/`created_at` frontmatter injected (there is no legacy
 `brain/knowledge/` fallback — ADR-0012 / #79, both wing and hall are
 required).
 ```bash
-$ cat <<EOF | hyperguild brain write homelab facts example-lesson
+$ cat <<EOF | hyperguild brain write knowledge example-lesson
 # Example lesson
 ## Lesson
 ...
 EOF
-wiki/homelab/facts/example-lesson.md
+knowledge/example-lesson.md
 ```
 ### `hyperguild brain pass-rate <skill>`
@@ -60,14 +60,13 @@ func runBrainWrite(ctx context.Context, args []string, stdin io.Reader, stdout,
 	if err := fs.Parse(args); err != nil {
 		return fmt.Errorf("parse flags: %w", err)
 	}
-	if fs.NArg() < 3 {
+	if fs.NArg() < 2 {
-		return errors.New("wing, hall and slug required (e.g. brain write homelab facts my-slug)")
+		return errors.New("type and slug required (e.g. brain write knowledge my-slug)")
 	}
-	wing := fs.Arg(0)
+	kind := fs.Arg(0)
-	hall := fs.Arg(1)
+	slug := fs.Arg(1)
 	slug := fs.Arg(2)
-	res, err := newBrainClient().Write(ctx, wing, hall, slug, stdin)
+	res, err := newBrainClient().Write(ctx, kind, slug, stdin)
 	if err != nil {
 		return err
 	}
@@ -101,7 +101,7 @@ func TestRunBrainWrite_Success(t *testing.T) {
 	var out, errBuf bytes.Buffer
 	err := runBrain(
 		context.Background(),
-		[]string{"write", "homelab", "facts", "test-slug"},
+		[]string{"write", "knowledge", "test-slug"},
 		strings.NewReader("# Test\n\nSome body content.\n"),
 		&out, &errBuf,
 	)
@@ -111,9 +111,9 @@ func TestRunBrainWrite_Success(t *testing.T) {
 func TestRunBrainWrite_MissingArgs(t *testing.T) {
 	var out, errBuf bytes.Buffer
-	err := runBrain(context.Background(), []string{"write", "homelab"}, strings.NewReader("x"), &out, &errBuf)
+	err := runBrain(context.Background(), []string{"write", "knowledge"}, strings.NewReader("x"), &out, &errBuf)
 	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "wing, hall and slug required")
+	assert.Contains(t, err.Error(), "type and slug required")
 }
 func TestRunBrainWrite_BackendError(t *testing.T) {
@@ -127,7 +127,7 @@ func TestRunBrainWrite_BackendError(t *testing.T) {
 	var out, errBuf bytes.Buffer
 	err := runBrain(
 		context.Background(),
-		[]string{"write", "homelab", "facts", "bad slug"},
+		[]string{"write", "knowledge", "bad slug"},
 		strings.NewReader("body"),
 		&out, &errBuf,
 	)
@@ -150,7 +150,7 @@ func TestRunBrainWrite_EmptyStdin(t *testing.T) {
 	t.Setenv("BRAIN_URL", srv.URL)
 	var out, errBuf bytes.Buffer
-	err := runBrain(context.Background(), []string{"write", "homelab", "facts", "empty"}, strings.NewReader(""), &out, &errBuf)
+	err := runBrain(context.Background(), []string{"write", "knowledge", "empty"}, strings.NewReader(""), &out, &errBuf)
 	require.NoError(t, err)
 	assert.Equal(t, 0, gotLen, "empty stdin should produce empty content payload")
 }
@@ -20,7 +20,6 @@ const defaultBrainURL = "http://koala:30330"
 // shell-friendly client; MCP framing is unnecessary.
 type brainClient struct {
 	baseURL string
 	token   string // BRAIN_MCP_TOKEN; the REST API requires it since hyperguild#149
 	http    *http.Client
 }
@@ -31,7 +30,6 @@ func newBrainClient() *brainClient {
 	}
 	return &brainClient{
 		baseURL: u,
 		token:   os.Getenv("BRAIN_MCP_TOKEN"),
 		http:    &http.Client{Timeout: 5 * time.Second},
 	}
 }
@@ -64,7 +62,8 @@ func (c *brainClient) Query(ctx context.Context, topic string, limit int) (*Quer
 		return nil, fmt.Errorf("build request: %w", err)
 	}
 	req.Header.Set("Content-Type", "application/json")
-	resp, err := c.do(req)
+
 	resp, err := c.http.Do(req)
 	if err != nil {
 		return nil, fmt.Errorf("brain POST /query: %w", err)
 	}
@@ -85,17 +84,16 @@ type WriteResult struct {
 	Path string `json:"path"`
 }
-func (c *brainClient) Write(ctx context.Context, wing, hall, filename string, content io.Reader) (*WriteResult, error) {
+func (c *brainClient) Write(ctx context.Context, kind, slug string, content io.Reader) (*WriteResult, error) {
 	body, err := io.ReadAll(content)
 	if err != nil {
 		return nil, fmt.Errorf("read content: %w", err)
 	}
 	payload, err := json.Marshal(struct {
-		Wing     string `json:"wing"`
+		Type    string `json:"type"`
-		Hall     string `json:"hall"`
+		Slug    string `json:"slug"`
 		Filename string `json:"filename"`
 		Content string `json:"content"`
-	}{Wing: wing, Hall: hall, Filename: filename, Content: string(body)})
+	}{Type: kind, Slug: slug, Content: string(body)})
 	if err != nil {
 		return nil, fmt.Errorf("marshal payload: %w", err)
 	}
@@ -106,7 +104,8 @@ func (c *brainClient) Write(ctx context.Context, wing, hall, filename string, co
 		return nil, fmt.Errorf("build request: %w", err)
 	}
 	req.Header.Set("Content-Type", "application/json")
-	resp, err := c.do(req)
+
 	resp, err := c.http.Do(req)
 	if err != nil {
 		return nil, fmt.Errorf("brain POST /write: %w", err)
 	}
@@ -143,7 +142,7 @@ func (c *brainClient) PassRate(ctx context.Context, skill, window string) (*Pass
 	if err != nil {
 		return nil, fmt.Errorf("build request: %w", err)
 	}
-	resp, err := c.do(req)
+	resp, err := c.http.Do(req)
 	if err != nil {
 		return nil, fmt.Errorf("brain GET /pass-rate: %w", err)
 	}
@@ -158,13 +157,3 @@ func (c *brainClient) PassRate(ctx context.Context, skill, window string) (*Pass
 	}
 	return &out, nil
 }
 // do sends every brain request, adding the bearer token when one is
 // configured. All methods go through here so none can forget it (PassRate
 // did, PR #152 review).
 func (c *brainClient) do(req *http.Request) (*http.Response, error) {
 	if c.token != "" {
 		req.Header.Set("Authorization", "Bearer "+c.token)
 	}
 	return c.http.Do(req)
 }
@@ -1,57 +0,0 @@
 package main
 import (
 	"context"
 	"net/http"
 	"net/http/httptest"
 	"strings"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 // hyperguild#149: the ingestion REST API now requires a bearer token; the CLI
 // sends BRAIN_MCP_TOKEN, or it gets 401 on every brain call.
 func TestBrainClientSendsBrainMCPTokenOnQueryWriteAndPassRate(t *testing.T) {
 	var got []string
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		got = append(got, r.URL.Path+" "+r.Header.Get("Authorization"))
 		switch r.URL.Path {
 		case "/write":
 			_, _ = w.Write([]byte(`{"path":"wiki/x/facts/y.md"}`))
 			return
 		case "/pass-rate":
 			_, _ = w.Write([]byte(`{}`))
 			return
 		}
 		_, _ = w.Write([]byte(`{"results":[]}`))
 	}))
 	defer srv.Close()
 	t.Setenv("BRAIN_URL", srv.URL)
 	t.Setenv("BRAIN_MCP_TOKEN", "cli-test-token")
 	c := newBrainClient()
 	_, err := c.Query(context.Background(), "x", 1)
 	require.NoError(t, err)
 	_, err = c.Write(context.Background(), "x", "facts", "y", strings.NewReader("# y"))
 	require.NoError(t, err)
 	// PR #152 review: PassRate sent no token and would 401 in production.
 	_, _ = c.PassRate(context.Background(), "tdd", "7d")
 	assert.Equal(t, []string{"/query Bearer cli-test-token", "/write Bearer cli-test-token",
 		"/pass-rate Bearer cli-test-token"}, got)
 }
 func TestBrainClientSendsNoAuthorizationWhenTokenUnset(t *testing.T) {
 	var auth string
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		auth = r.Header.Get("Authorization")
 		_, _ = w.Write([]byte(`{"results":[]}`))
 	}))
 	defer srv.Close()
 	t.Setenv("BRAIN_URL", srv.URL)
 	t.Setenv("BRAIN_MCP_TOKEN", "")
 	_, err := newBrainClient().Query(context.Background(), "x", 1)
 	require.NoError(t, err)
 	assert.Empty(t, auth)
 }
@@ -65,25 +65,23 @@ func TestBrainClient_Write_Success(t *testing.T) {
 		assert.Equal(t, http.MethodPost, r.Method)
 		body, _ := io.ReadAll(r.Body)
 		var got struct {
-			Wing     string `json:"wing"`
+			Type    string `json:"type"`
-			Hall     string `json:"hall"`
+			Slug    string `json:"slug"`
 			Filename string `json:"filename"`
 			Content string `json:"content"`
 		}
 		require.NoError(t, json.Unmarshal(body, &got))
-		assert.Equal(t, "homelab", got.Wing)
+		assert.Equal(t, "knowledge", got.Type)
-		assert.Equal(t, "facts", got.Hall)
+		assert.Equal(t, "find-h", got.Slug)
 		assert.Equal(t, "find-h", got.Filename)
 		assert.Equal(t, "# body\n", got.Content)
 		w.Header().Set("Content-Type", "application/json")
-		_, _ = w.Write([]byte(`{"path":"wiki/homelab/facts/find-h.md"}`))
+		_, _ = w.Write([]byte(`{"path":"knowledge/find-h.md"}`))
 	}))
 	defer srv.Close()
 	c := &brainClient{baseURL: srv.URL, http: srv.Client()}
-	res, err := c.Write(context.Background(), "homelab", "facts", "find-h", strings.NewReader("# body\n"))
+	res, err := c.Write(context.Background(), "knowledge", "find-h", strings.NewReader("# body\n"))
 	require.NoError(t, err)
-	assert.Equal(t, "wiki/homelab/facts/find-h.md", res.Path)
+	assert.Equal(t, "knowledge/find-h.md", res.Path)
 }
 func TestBrainClient_PassRate_Success(t *testing.T) {
@@ -0,0 +1,26 @@
 # Model selection — first entry per skill is used.
 # Override per-call by passing model in the MCP tool args.
 # Model names come from LiteLLM /v1/models (host/name format).
 default_chain:
  - iguana/qwen3-coder-next
 skills:
  tdd:
    chain:
      - koala/qwen3-coder-30b
  review:
    chain:
      - iguana/devstral
  debug:
    chain:
      - iguana/deepseek-r1-14b
  spec:
    chain:
      - koala/phi4-14b
  retrospective:
    chain:
      - iguana/qwen3-coder-next
  trainer:
    chain:
      - iguana/qwen3-coder-next
@@ -24,7 +24,7 @@ Only a `tools/call` to the routing pod records a pass/fail.
 |---------|-----|------|
 | Routing MCP (local, Tailscale) | `http://koala:30310/mcp` | Bearer `ROUTING_MCP_TOKEN` |
 | Routing MCP (remote) | `https://routing-mcp.d-ma.be/mcp` | OAuth via `auth.d-ma.be` (audience `claude-ai`) |
-| Pass-rate readout | `http://koala:30330/pass-rate?skill=<name>` | Bearer `BRAIN_MCP_TOKEN` (since hyperguild#149) |
+| Pass-rate readout | `http://koala:30330/pass-rate?skill=<name>` | none (read-only) |
 Tools advertised: **`review`**, **`debug`** (the two the #35 gate measures),
 plus `session_log`, `retrospective`, `trainer`.
@@ -1051,7 +1051,7 @@ git push
 ```bash
 # Poll until complete (replace RUN_ID with the new run):
 curl -s "https://gitea.d-ma.be/api/v1/repos/mathias/hyperguild/actions/runs?limit=2" \
-  -H "Authorization: token <REDACTED-dead-gitea-pat-infra#344>" \
+  -H "Authorization: token 736a8c36adcc6ecb41fff56e5ae4d0eb3105a670" \
  | python3 -c "import sys,json; [print(r['id'],r['status'],r.get('conclusion','—')) for r in json.load(sys.stdin)['workflow_runs']]"
 ```
@@ -16,7 +16,7 @@ Three needs converge on a single small Go binary:
 - [ ] `hyperguild tier` returns the same `tier.Info` that `internal/tier.Detect` produces for the same probe URLs, in < 3 s under all three tier conditions, with both human-readable and `--json` output.
 - [ ] `hyperguild brain query <topic>` returns BM25 results from the brain HTTP REST `/query` endpoint, exit 0 on success and non-zero on transport failure.
- [ ] `hyperguild brain write <wing> <hall> <slug>` reads markdown content from stdin, posts to `/write` with wing/hall/filename, and creates `brain/wiki/<wing>/<hall>/<slug>.md`. A round-trip (`hyperguild brain query <slug>` immediately after) finds the entry. (Updated post-ADR-0012/#79: the legacy `<type> <slug>` shape and the `brain/knowledge/` fallback were removed; wing and hall are now required.)
+- [ ] `hyperguild brain write <type> <slug>` reads markdown content from stdin, posts to `/write` with the type and slug, and creates `brain/knowledge/<slug>.md`. A round-trip (`hyperguild brain query <slug>` immediately after) finds the entry.
 - [ ] `hyperguild mode <cloud|client-local|sovereign>` writes a parseable JSON file at the target path with the per-mode `mcpServers` entries; `jq -e .mcpServers` succeeds on the output.
 - [ ] All commands print usage on `--help`, exit 2 on unknown flags, exit non-zero on operational errors.
 - [ ] `task check` passes (lint + test + vet) on each task and on the merged branch.
@@ -50,7 +50,7 @@ Three needs converge on a single small Go binary:
 - **`brain` subcommand calls the HTTP REST API.** Two nested subcommands:
  - `brain query <topic>` issues `POST /query` with JSON body `{query, limit}` (default `--limit 5`), prints results in human-readable form by default and with `--json` for machine consumption.
-  - `brain write <wing> <hall> <slug>` reads stdin, posts `POST /write` with JSON body `{wing, hall, filename, content}`, prints the resulting path on success. (Updated post-ADR-0012/#79: wing and hall are required, replacing the old `<type> <slug>` shape and the `brain/knowledge/` legacy fallback.)
+  - `brain write <type> <slug>` reads stdin, posts `POST /write` with JSON body `{type, slug, content}`, prints the resulting path on success.
  Rationale: HTTP REST is simpler than MCP framing for a CLI. Per CLAUDE.md, the REST endpoints are documented as the official non-MCP interface.
 - **`mode <name>` writes a per-mode `.mcp.json` template.** Defaults to writing `./.mcp.json` (cwd); accepts `--out <path>`. Per-mode bodies:
@@ -1,53 +0,0 @@
 // Command frontmatterlint reports markdown notes whose YAML frontmatter does
 // not parse, and optionally repairs the ones that only need quoting.
 //
 //	go run ./cmd/frontmatterlint ../../brain          # report
 //	go run ./cmd/frontmatterlint -fix ../../brain     # repair in place
 //
 // Exit codes: 0 clean (or everything repaired), 1 findings remain, 2 the scan
 // itself failed.
 package main
 import (
 	"flag"
 	"fmt"
 	"os"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/frontmatter"
 )
 func main() {
 	fix := flag.Bool("fix", false, "repair files that quoting can rescue, in place")
 	flag.Parse()
 	root := "."
 	if flag.NArg() > 0 {
 		root = flag.Arg(0)
 	}
 	findings, err := frontmatter.Scan(root, *fix)
 	if err != nil {
 		fmt.Fprintln(os.Stderr, "frontmatterlint:", err)
 		os.Exit(2)
 	}
 	var unresolved int
 	for _, f := range findings {
 		if f.Repaired {
 			fmt.Printf("repaired  %s\n", f.Path)
 			continue
 		}
 		unresolved++
 		fmt.Printf("BROKEN    %s: %v\n", f.Path, f.Err)
 	}
 	if unresolved > 0 {
 		fmt.Fprintf(os.Stderr, "\n%d file(s) with unparseable frontmatter", unresolved)
 		if !*fix {
 			fmt.Fprint(os.Stderr, " — re-run with -fix")
 		}
 		fmt.Fprintln(os.Stderr)
 		os.Exit(1)
 	}
 	fmt.Printf("✓ frontmatter: %d file(s) repaired, none broken\n", len(findings))
 }
@@ -32,8 +32,6 @@ import (
 	"github.com/mathiasbq/hyperguild/ingestion/internal/pipeline"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/reranker"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/search"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/startupretry"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/symlinkguard"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/vectorstore"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/watcher"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/webhook"
@@ -145,48 +143,6 @@ func envInt(key string, fallback int) int {
 	return fallback
 }
 // buildNotifier returns the ntfy notifier, or a nil interface when
 // BRAIN_NTFY_URL is unset. A nil *interface* (not a typed-nil) is required so
 // DegradingSink/Reconcile and the governance observer skip it cleanly.
 // alertingWarnings names every alert that will not fire under the current
 // configuration (#107).
 //
 // buildNotifier returns a nil interface when BRAIN_NTFY_URL is unset, and every
 // consumer skips a nil notifier silently — right for an unconfigured homelab,
 // wrong for an alert whose entire value is that someone finds out. The cost of
 // the silence is that "configured and working" and "never configured" are
 // byte-identical in behaviour: no error, no warning, only a message that never
 // arrives, which nobody notices because nobody is waiting for an alert they
 // have never seen. Two alerts were dark in production for exactly that reason
 // (#100), found by firing a real event rather than by reading anything.
 //
 // WARN rather than fatal, deliberately. The brain sibling rule
 // (`empty-credential-must-refuse-to-start-not-switch-modes`) says an empty
 // credential must be a startup error, never a silent mode switch — but that is
 // about a control being removed. Here observability is degraded, not a gate
 // bypassed, and refusing to boot would break the unconfigured-homelab case the
 // nil notifier exists to support. What the rule does demand, and what this
 // provides, is that the mode switch stops being silent.
 //
 // Pure and env-injected so the message is testable without a running server:
 // the reason this gap survived is that nothing about it was observable.
 func alertingWarnings(getenv func(string) string) []string {
 	var out []string
 	if getenv("BRAIN_NTFY_URL") == "" {
 		out = append(out, "alerting DISABLED: BRAIN_NTFY_URL unset — "+
 			"brain_edit_root governance rewrites, capture audit degradation and the "+
 			"brain symlink tripwire (hyperguild#157) will not notify")
 	}
 	return out
 }
 func buildNotifier() audit.Notifier {
 	if n := audit.NewNtfyNotifier(os.Getenv("BRAIN_NTFY_URL"), os.Getenv("BRAIN_NTFY_TOKEN")); n != nil {
 		return n
 	}
 	return nil
 }
 // buildAuditSink selects the capture audit sink. When BRAIN_LOKI_URL is
 // set it builds the classification-aware DegradingSink (loki central +
 // durable file buffer + optional ntfy) and starts the reconcile loop;
@@ -204,7 +160,12 @@ func buildAuditSink(ctx context.Context, brainDir string, logger *slog.Logger) c
 		logger.Error("capture audit buffer init", "err", err)
 		os.Exit(1)
 	}
-	notifier := buildNotifier()
+	// Keep notifier as a nil interface (not a typed-nil) when unconfigured
 	// so DegradingSink/Reconcile skip it cleanly.
 	var notifier audit.Notifier
 	if n := audit.NewNtfyNotifier(os.Getenv("BRAIN_NTFY_URL"), os.Getenv("BRAIN_NTFY_TOKEN")); n != nil {
 		notifier = n
 	}
 	reconcileInterval := time.Duration(envInt("BRAIN_AUDIT_RECONCILE_INTERVAL", 60)) * time.Second
 	audit.StartReconcile(ctx, central, buffer, notifier, reconcileInterval)
 	logger.Info("capture audit: loki+buffer sink", "loki", lokiURL, "reconcile_s", int(reconcileInterval.Seconds()))
@@ -236,15 +197,7 @@ func systemHostname() string {
 func main() {
 	logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))
 	for _, w := range alertingWarnings(os.Getenv) {
 		logger.Warn(w)
 	}
 	brainDir := envOr("INGEST_BRAIN_DIR", "../brain")
 	if err := startupSymlinkCheck(brainDir); err != nil {
 		logger.Error("brain symlink tripwire", "err", err)
 		os.Exit(1)
 	}
 	port := envOr("INGEST_PORT", "3300")
 	llmURL := envOr("INGEST_LLM_URL", "http://iguana:4000/v1")
@@ -277,11 +230,6 @@ func main() {
 			fallbackModel := envOr("BRAIN_LLM_FALLBACK_MODEL", "gemma4:31b")
 			router.Fallback = llm.New(fallbackURL, "", fallbackModel, timeout)
 		}
 		if tertiaryURL := os.Getenv("BRAIN_LLM_TERTIARY_URL"); tertiaryURL != "" {
 			tertiaryModel := envOr("BRAIN_LLM_TERTIARY_MODEL", "gemini-2.5-flash")
 			tertiaryKey := os.Getenv("GEMINI_API_KEY")
 			router.Tertiary = llm.New(tertiaryURL, tertiaryKey, tertiaryModel, timeout)
 		}
 		answerComplete = router.Complete
 		logger.Info("brain answer LLM configured", "primary", primaryURL, "model", primaryModel)
 	}
@@ -366,38 +314,6 @@ func main() {
 	}
 	ctx := context.Background()
 	// hyperguild#157: report a symlink that appears in the brain while running.
 	go symlinkguard.Watch(ctx, brainDir, symlinkScanInterval(os.Getenv), buildNotifier())
 	// Built before the watcher, the graph backfill and session ingestion, and
 	// retried rather than fatal (#83). Two separate reasons:
 	//
 	//   - On a cold cluster boot this pod can beat dex to serving and gets a
 	//     502 from ingress. Nothing is misconfigured; it simply started first.
 	//     Exiting there meant CrashLoopBackOff redoing the backfill on every
 	//     attempt, with exponential backoff stretching the brain outage.
 	//   - Constructing it first means a genuine config error (wrong issuer,
 	//     bad audience) fails in seconds instead of after all that work.
 	//
 	// The budget stays bounded: retrying forever would turn a misconfiguration
 	// into a process that looks alive and never serves.
 	jwtValidator, err := startupretry.Do(ctx,
 		startupretry.Policy{Attempts: 8, Base: time.Second, Max: 30 * time.Second},
 		func(ctx context.Context) (*chassisauth.JWTValidator, error) {
 			v, err := chassisauth.NewJWTValidator(ctx, os.Getenv("DEX_ISSUER_URL"), os.Getenv("MCP_AUDIENCE"))
 			if err != nil {
 				logger.Warn("oidc discovery not ready, retrying", "err", err)
 			}
 			return v, err
 		})
 	if err != nil {
 		logger.Error("build jwt validator", "err", err)
 		os.Exit(1)
 	}
 	if jwtValidator != nil {
 		logger.Info("jwt auth enabled", "issuer", os.Getenv("DEX_ISSUER_URL"))
 	}
 	if watchInterval > 0 {
 		watcher.Start(ctx, watcher.Config{
 			BrainDir: brainDir,
@@ -439,29 +355,6 @@ func main() {
 		}
 		host := envOr("CLAUDE_INGEST_HOST", systemHostname())
 		interval := time.Duration(envInt("CLAUDE_INGEST_INTERVAL", 60)) * time.Second
 		// Project directories excluded from ingestion entirely, as globs
 		// against the project directory name — e.g.
 		// "*cobalt-dingo*,*claude-worktrees-bridge-cse*".
 		//
 		// This is a veto list, deliberately named as one. It complements the
 		// client-name scrubber rather than replacing it: the scrubber drops
 		// individual TURNS whose content matches, while this never opens a
 		// project's files at all. Sessions working on live company financials
 		// are excluded here because their content is confidential in ways no
 		// pattern reliably recognises, and their learnings are captured
 		// deliberately through the session-close ritual instead.
 		//
 		// Caveat worth knowing: a project directory is derived from the
 		// session's WORKING DIRECTORY, not from the repositories it touches.
 		// A session run from ~/dev that happens to read a skipped repo will
 		// NOT be excluded by this. The scrubber remains the control for
 		// content; this is a control for whole workspaces.
 		skipProjects := splitList(os.Getenv("CLAUDE_INGEST_SKIP_PROJECTS"))
 		if len(skipProjects) > 0 {
 			logger.Info("claudewatcher: projects excluded from ingestion", "patterns", skipProjects)
 		}
 		sink := &claudeSink{brainDir: brainDir, logger: logger}
 		go func() {
 			if err := claudewatcher.Watch(ctx, claudewatcher.Config{
@@ -471,7 +364,6 @@ func main() {
 				Sink:        sink,
 				Cursors:     cursorStore,
 				Logger:      logger,
 				SkipProjects: skipProjects,
 			}); err != nil && err != context.Canceled {
 				logger.Error("claudewatcher exited", "err", err)
 			}
@@ -511,25 +403,44 @@ func main() {
 		logger.Info("embed sync started", "interval_s", embedSyncInterval)
 	}
-	// Public routes only; buildMux mounts the authenticated REST API (#149).
+	mux := http.NewServeMux()
-	public := map[string]http.Handler{}
+	mux.HandleFunc("POST /query", h.Query)
 	mux.HandleFunc("POST /write", h.Write)
 	mux.HandleFunc("POST /index", h.Index)
 	mux.HandleFunc("POST /ingest", h.Ingest)
 	mux.HandleFunc("POST /ingest-path", h.IngestPath)
 	mux.HandleFunc("POST /ingest-raw", h.IngestRaw)
 	mux.HandleFunc("POST /backfill-refs", h.BackfillRefs)
 	mux.HandleFunc("GET /pending", h.Pending)
 	mux.HandleFunc("POST /promote", h.Promote)
 	mux.HandleFunc("POST /backfill-embeddings", h.BackfillEmbeddings)
 	mux.HandleFunc("GET /pass-rate", h.PassRate)
 	if webhookHandler != nil {
-		public["POST /webhooks/brain-sync"] = webhookHandler
+		mux.Handle("POST /webhooks/brain-sync", webhookHandler)
 	}
 	jwtValidator, err := chassisauth.NewJWTValidator(ctx, os.Getenv("DEX_ISSUER_URL"), os.Getenv("MCP_AUDIENCE"))
 	if err != nil {
 		logger.Error("build jwt validator", "err", err)
 		os.Exit(1)
 	}
 	if jwtValidator != nil {
 		logger.Info("jwt auth enabled", "issuer", os.Getenv("DEX_ISSUER_URL"))
 	}
 	// Resource-metadata URL is only emitted on 401 when Dex OAuth is
 	// configured. Static-Bearer-only deployments leave this empty so
 	// clients never see an OAuth challenge.
 	var resourceMetadataURL string
 	if dexURL := os.Getenv("DEX_ISSUER_URL"); dexURL != "" {
 		resourceURL := os.Getenv("MCP_RESOURCE_URL")
-		public["GET /.well-known/oauth-protected-resource"] = http.HandlerFunc(
+		mux.HandleFunc("GET /.well-known/oauth-protected-resource",
 			chassisauth.ProtectedResourceHandler(resourceURL, dexURL))
 		if resourceURL != "" {
 			resourceMetadataURL = strings.TrimRight(resourceURL, "/") + "/.well-known/oauth-protected-resource"
 		}
 	}
-	public["/mcp"] = chassisauth.BearerMiddleware(mcpToken, jwtValidator, "brain", resourceMetadataURL, mcpSrv)
+	mux.Handle("/mcp", chassisauth.BearerMiddleware(mcpToken, jwtValidator, "brain", resourceMetadataURL, mcpSrv))
 	// POST /capture (#53/#54): the uniform capture REST door. Needs a ticket
 	// tracker to file action items, so it only mounts when Gitea is
@@ -551,19 +462,13 @@ func main() {
 		sovereign := splitList(os.Getenv("BRAIN_CAPTURE_SOVEREIGN_PRINCIPALS"))
 		resolver := capturehttp.NewOriginResolver(sovereign)
 		captureH := capturehttp.New(captureSvc, jwtValidator, mcpToken, "local-cli", resolver)
-		public["POST /capture"] = captureH
+		mux.Handle("POST /capture", captureH)
 		// Same use-case behind the MCP `capture` tool (#55 relay) so MCP-native
 		// harnesses (claude.ai, Crush, Pi, LLM Council) reach capture through
 		// the existing /mcp OAuth connector. mcpSrv is already wrapped above;
 		// WithCapture mutates the same instance, so the tool appears live.
 		mcpSrv.WithCapture(captureSvc, jwtValidator, mcpToken, "local-cli", resolver)
-		// hyperguild#97: a governance-file rewrite gets the same trail a
+		logger.Info("capture enabled (REST + MCP tool)", "sovereign_principals", len(sovereign))
 		// capture already gets, plus an out-of-band alert. Wired here because
 		// brain_edit_root needs the capture plumbing anyway — that is what
 		// re-derives the static principal its gate checks.
 		mcpSrv.WithGovernanceObserver(auditSink, buildNotifier())
 		logger.Info("capture enabled (REST + MCP tool)", "sovereign_principals", len(sovereign),
 			"governance_observer", true)
 	} else {
 		logger.Info("capture endpoint disabled (BRAIN_GITEA_TOKEN unset)")
 	}
@@ -581,9 +486,9 @@ func main() {
 			logger.Error("OAUTH_CLIENT_ID/SECRET set but MCP_RESOURCE_URL is empty; cannot derive issuer")
 			os.Exit(1)
 		}
-		public["GET /.well-known/oauth-authorization-server"] = http.HandlerFunc(
+		mux.HandleFunc("GET /.well-known/oauth-authorization-server",
 			oauth.MetadataHandler(issuer))
-		public["POST /oauth/token"] = http.HandlerFunc(oauth.TokenHandler(oauth.TokenConfig{
+		mux.HandleFunc("POST /oauth/token", oauth.TokenHandler(oauth.TokenConfig{
 			ClientID:     oauthID,
 			ClientSecret: oauthSecret,
 			AccessToken:  mcpToken,
@@ -602,17 +507,7 @@ func main() {
 	// real request latency. /metrics itself is excluded from its own
 	// observation by registering it on the outer mux (post-wrap).
 	reg := metrics.New()
-	public["GET /metrics"] = http.HandlerFunc(reg.Handler())
+	mux.HandleFunc("GET /metrics", reg.Handler())
 	// The whole router, built in one place so the test of buildMux is a test
 	// of production wiring (PR #152 review). The REST API's credential is the
 	// same as /mcp's.
 	mux, err := buildMux(restAuth{token: mcpToken, validator: jwtValidator, realm: "brain",
 		resourceMetadataURL: resourceMetadataURL}, h, public)
 	if err != nil {
 		logger.Error("build router", "err", err)
 		os.Exit(1)
 	}
 	logger.Info("metrics endpoint registered", "path", "/metrics")
 	addr := ":" + port
@@ -6,7 +6,6 @@ import (
 	"log/slog"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 	"github.com/stretchr/testify/assert"
@@ -37,42 +36,3 @@ func TestClaudeSink_IngestWritesToNonIndexedArchiveNotWiki(t *testing.T) {
 	_, err = os.Stat(filepath.Join(dir, "wiki", "claude-sessions"))
 	assert.True(t, os.IsNotExist(err), "raw transcripts must never land under wiki/ (ai-sessions#10 — BM25 pollution)")
 }
 // --- #107: an unconfigured alert must announce itself ----------------------
 func TestAlertingWarnings(t *testing.T) {
 	tests := []struct {
 		name string
 		env  map[string]string
 		want []string // substrings that must appear across the warnings
 		none bool     // true = expect no warnings at all
 	}{
 		{
 			// The failure this exists to prevent: two alerts dark in
 			// production, discovered only by firing a real event and watching
 			// nothing arrive (#100).
 			name: "notifier unconfigured names what will not fire",
 			env:  map[string]string{},
 			want: []string{"BRAIN_NTFY_URL", "brain_edit_root", "audit"},
 		},
 		{
 			name: "configured notifier is silent",
 			env:  map[string]string{"BRAIN_NTFY_URL": "http://ntfy/brain-alerts"},
 			none: true,
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			got := alertingWarnings(func(k string) string { return tt.env[k] })
 			if tt.none {
 				assert.Empty(t, got)
 				return
 			}
 			joined := strings.Join(got, " ")
 			for _, w := range tt.want {
 				assert.Contains(t, joined, w)
 			}
 		})
 	}
 }
@@ -1,77 +0,0 @@
 package main
 import (
 	"errors"
 	"fmt"
 	"net/http"
 	chassisauth "git.d-ma.be/mathias/mcp-chassis/auth"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
 )
 // publicRoutes is the complete set of patterns allowed on the outer mux,
 // outside the REST API's auth (hyperguild#149). Each authenticates itself or is
 // meant to be open: /mcp (bearer/JWT), /capture (bearer/JWT), the webhook
 // (HMAC), /oauth/token (client secret), OAuth metadata and /metrics (open).
 // A REST pattern added here would beat the authenticated catch-all by
 // specificity and ship open, which is why buildMux refuses anything else.
 var publicRoutes = map[string]bool{
 	"/mcp":                      true,
 	"POST /capture":             true,
 	"POST /webhooks/brain-sync": true,
 	"GET /.well-known/oauth-protected-resource":   true,
 	"GET /.well-known/oauth-authorization-server": true,
 	"POST /oauth/token":                           true,
 	"GET /metrics":                                true,
 }
 // restAuth is the credential the REST API checks: the same as /mcp's.
 type restAuth struct {
 	token               string
 	validator           *chassisauth.JWTValidator
 	realm               string
 	resourceMetadataURL string
 }
 // buildMux is the server's whole router. The REST API is mounted at "/"
 // behind bearer auth that buildMux constructs itself, so a caller cannot pass
 // a no-op; public handlers are registered as given, and only for patterns on
 // the publicRoutes allowlist. It returns an http.Handler, not the
 // *ServeMux, so nothing can register a route on the result afterwards and
 // bypass the allowlist.
 func buildMux(auth restAuth, h *api.Handler, public map[string]http.Handler) (http.Handler, error) {
 	if auth.token == "" {
 		return nil, errors.New("buildMux: REST auth needs a token")
 	}
 	mux := http.NewServeMux()
 	for pattern, handler := range public {
 		if !publicRoutes[pattern] {
 			return nil, fmt.Errorf("buildMux: %q is not an allowed public route", pattern)
 		}
 		mux.Handle(pattern, handler)
 	}
 	mountREST(mux, h, func(next http.Handler) http.Handler {
 		return chassisauth.BearerMiddleware(auth.token, auth.validator, auth.realm, auth.resourceMetadataURL, next)
 	})
 	return mux, nil
 }
 // mountREST registers the REST API on its own mux and mounts it at "/" behind
 // auth: anything not registered as public lands here and is authenticated,
 // including routes added later.
 func mountREST(mux *http.ServeMux, h *api.Handler, auth func(http.Handler) http.Handler) {
 	rest := http.NewServeMux()
 	rest.HandleFunc("POST /query", h.Query)
 	rest.HandleFunc("POST /write", h.Write)
 	rest.HandleFunc("POST /index", h.Index)
 	rest.HandleFunc("POST /ingest", h.Ingest)
 	rest.HandleFunc("POST /ingest-path", h.IngestPath)
 	rest.HandleFunc("POST /ingest-raw", h.IngestRaw)
 	rest.HandleFunc("POST /backfill-refs", h.BackfillRefs)
 	rest.HandleFunc("GET /pending", h.Pending)
 	rest.HandleFunc("POST /promote", h.Promote)
 	rest.HandleFunc("POST /backfill-embeddings", h.BackfillEmbeddings)
 	rest.HandleFunc("GET /pass-rate", h.PassRate)
 	mux.Handle("/", auth(rest))
 }
@@ -1,106 +0,0 @@
 package main
 import (
 	"log/slog"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"strings"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/pipeline"
 )
 const routesTok = "routes-test-token"
 func okHandler(body string) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { _, _ = w.Write([]byte(body)) })
 }
 // testMux builds the router exactly as main does: buildMux with the full
 // public set main registers (stub handlers) and real bearer config.
 // hyperguild#149: the REST API is authenticated as a whole; the PR #152
 // review showed a test of a COPY of the router let main.go regress unseen.
 func testMux(t *testing.T) http.Handler {
 	t.Helper()
 	h := api.NewHandler(t.TempDir(), slog.New(slog.NewTextHandler(os.Stderr, nil)), pipeline.Config{})
 	public := map[string]http.Handler{}
 	for p := range publicRoutes {
 		public[p] = okHandler("public " + p)
 	}
 	mux, err := buildMux(restAuth{token: routesTok, realm: "brain"}, h, public)
 	require.NoError(t, err)
 	return mux
 }
 func do(t *testing.T, h http.Handler, method, path, authz string) (int, string) {
 	t.Helper()
 	req := httptest.NewRequest(method, path, strings.NewReader(`{"query":"x"}`))
 	if authz != "" {
 		req.Header.Set("Authorization", authz)
 	}
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, req)
 	return rec.Code, rec.Body.String()
 }
 func TestBuildMuxRefusesRESTRoutesWithoutAValidToken(t *testing.T) {
 	r := testMux(t)
 	for _, rt := range []struct{ method, path string }{
 		{"POST", "/query"}, {"POST", "/write"}, {"POST", "/index"}, {"POST", "/ingest"},
 		{"POST", "/ingest-path"}, {"POST", "/ingest-raw"}, {"POST", "/backfill-refs"},
 		{"GET", "/pending"}, {"POST", "/promote"}, {"POST", "/backfill-embeddings"}, {"GET", "/pass-rate"},
 	} {
 		code, _ := do(t, r, rt.method, rt.path, "")
 		assert.Equal(t, http.StatusUnauthorized, code, "%s %s without a token", rt.method, rt.path)
 		code, _ = do(t, r, rt.method, rt.path, "Bearer wrong")
 		assert.Equal(t, http.StatusUnauthorized, code, "%s %s with a wrong token", rt.method, rt.path)
 	}
 }
 func TestBuildMuxServesRESTRoutesToAValidToken(t *testing.T) {
 	r := testMux(t)
 	code, _ := do(t, r, "GET", "/pending", "Bearer "+routesTok)
 	assert.Equal(t, http.StatusOK, code)
 }
 func TestBuildMuxAuthenticatesAnUnregisteredPath(t *testing.T) {
 	code, _ := do(t, testMux(t), "POST", "/some-future-route", "")
 	assert.Equal(t, http.StatusUnauthorized, code)
 }
 // buildMux registers public handlers as given, without adding auth: each
 // public route owns its own (bearer on /mcp, HMAC on the webhook, client
 // secret on /oauth/token) or is meant to be open (/metrics, OAuth metadata).
 func TestBuildMuxDoesNotWrapPublicRoutes(t *testing.T) {
 	r := testMux(t)
 	for p := range publicRoutes {
 		method, path, ok := strings.Cut(p, " ")
 		if !ok {
 			method, path = "GET", p
 		}
 		code, body := do(t, r, method, path, "")
 		assert.Equal(t, http.StatusOK, code, p)
 		assert.Equal(t, "public "+p, body, p)
 	}
 }
 // The allowlist is the control: a REST pattern registered as public would win
 // over the authenticated catch-all (more specific pattern), so it is refused.
 func TestBuildMuxRefusesAPublicPatternOffTheAllowlist(t *testing.T) {
 	h := api.NewHandler(t.TempDir(), slog.New(slog.NewTextHandler(os.Stderr, nil)), pipeline.Config{})
 	for _, p := range []string{"POST /query", "GET /pending", "/", "POST /metrics"} {
 		_, err := buildMux(restAuth{token: routesTok, realm: "brain"}, h, map[string]http.Handler{p: okHandler("x")})
 		assert.Error(t, err, "public pattern %q must be refused", p)
 	}
 }
 func TestBuildMuxRefusesAnEmptyToken(t *testing.T) {
 	h := api.NewHandler(t.TempDir(), slog.New(slog.NewTextHandler(os.Stderr, nil)), pipeline.Config{})
 	_, err := buildMux(restAuth{token: "", realm: "brain"}, h, nil)
 	assert.Error(t, err)
 }
@@ -1,39 +0,0 @@
 package main
 import (
 	"errors"
 	"fmt"
 	"os"
 	"strconv"
 	"time"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/symlinkguard"
 )
 // startupSymlinkCheck is the hyperguild#157 tripwire at boot: a symlink in the
 // brain dir would let brain readers serve a file from outside the brain, so
 // the server does not start until it is removed. A directory the scan cannot
 // read could hide one, so it refuses on that too. A missing brain dir (first
 // boot) is the only case it lets pass.
 func startupSymlinkCheck(brainDir string) error {
 	r, err := symlinkguard.Scan(brainDir)
 	if err != nil {
 		if errors.Is(err, os.ErrNotExist) {
 			return nil
 		}
 		return fmt.Errorf("refusing to start: cannot scan the brain dir %s (hyperguild#157): %w", brainDir, err)
 	}
 	if !r.Clean() {
 		return fmt.Errorf("refusing to start: brain dir %s has %s (hyperguild#157); fix them first", brainDir, r)
 	}
 	return nil
 }
 // symlinkScanInterval reads BRAIN_SYMLINK_SCAN_INTERVAL (seconds), falling
 // back to the default on an unset, non-numeric or non-positive value.
 func symlinkScanInterval(getenv func(string) string) time.Duration {
 	if s, err := strconv.Atoi(getenv("BRAIN_SYMLINK_SCAN_INTERVAL")); err == nil && s > 0 {
 		return time.Duration(s) * time.Second
 	}
 	return symlinkguard.DefaultInterval
 }
@@ -1,65 +0,0 @@
 package main
 import (
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 // hyperguild#157: the server refuses to start while a symlink exists in the
 // brain dir, or while any part of it cannot be scanned (which could hide
 // one); a missing brain dir is the only thing it lets pass.
 func TestStartupSymlinkCheckRefusesABrainWithASymlink(t *testing.T) {
 	brain := t.TempDir()
 	require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(brain, "planted")))
 	err := startupSymlinkCheck(brain)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "planted")
 }
 func TestStartupSymlinkCheckRefusesABrainWithAnUnreadableDir(t *testing.T) {
 	if os.Geteuid() == 0 {
 		t.Skip("root reads mode-000 directories")
 	}
 	brain := t.TempDir()
 	locked := filepath.Join(brain, "aaa")
 	require.NoError(t, os.MkdirAll(locked, 0o755))
 	require.NoError(t, os.Chmod(locked, 0o000))
 	t.Cleanup(func() { _ = os.Chmod(locked, 0o755) })
 	err := startupSymlinkCheck(brain)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "aaa")
 }
 func TestStartupSymlinkCheckPassesACleanOrMissingBrain(t *testing.T) {
 	brain := t.TempDir()
 	require.NoError(t, os.WriteFile(filepath.Join(brain, "n.md"), []byte("x"), 0o644))
 	assert.NoError(t, startupSymlinkCheck(brain))
 	assert.NoError(t, startupSymlinkCheck(filepath.Join(brain, "missing")))
 }
 func TestSymlinkScanIntervalFallsBackOnNonPositive(t *testing.T) {
 	for _, v := range []string{"0", "-5", "", "junk"} {
 		got := symlinkScanInterval(func(string) string { return v })
 		assert.Positive(t, got, "env %q", v)
 	}
 }
 func TestAlertingWarningsNamesTheSymlinkTripwire(t *testing.T) {
 	w := strings.Join(alertingWarnings(func(string) string { return "" }), " ")
 	assert.Contains(t, w, "symlink tripwire")
 }
 func TestStartupSymlinkCheckRefusesAnUnlistableBrainRoot(t *testing.T) {
 	if os.Geteuid() == 0 {
 		t.Skip("root lists mode-0100 directories")
 	}
 	brain := t.TempDir()
 	require.NoError(t, os.Chmod(brain, 0o100))
 	t.Cleanup(func() { _ = os.Chmod(brain, 0o755) })
 	assert.Error(t, startupSymlinkCheck(brain))
 }
@@ -1,12 +1,6 @@
 package api
-import (
+import "strings"
 	"strings"
 	// Aliased: this package's own frontmatter type (below) would collide
 	// with the imported package's name otherwise.
 	sharedfm "github.com/mathiasbq/hyperguild/ingestion/internal/frontmatter"
 )
 // frontmatter is an ordered, line-preserving view of a note's YAML
 // frontmatter block. It deliberately avoids a full YAML round-trip: the
@@ -31,37 +25,21 @@ type fmLine struct {
 // frontmatter block is recognised only when the file opens with a `---`
 // fence and a closing `---` fence follows. Otherwise the whole input is
 // the body and the returned frontmatter is empty.
 //
 // Fence detection itself is frontmatter.Split (hyperguild#138) — this
 // package's own contribution is purely the ordered, line-preserving fmLine
 // shape below, which a shared parser has no business owning since it's
 // specific to how brain_update does a surgical, byte-round-trip edit.
 func parseFrontmatter(src string) (frontmatter, string) {
 	var fm frontmatter
-	blockBytes, restBytes, ok := sharedfm.Split([]byte(src))
+	if !strings.HasPrefix(src, "---\n") {
 	if !ok {
 		return fm, src
 	}
-	// sharedfm.Split's block/rest boundary sits one byte earlier than this
+	rest := src[len("---\n"):]
-	// package's always has: block keeps the "\n" immediately before the
+	end := strings.Index(rest, "\n---\n")
-	// closing fence, and rest keeps the "\n" immediately after it (both by
+	if end < 0 {
-	// design, for Fix's own reconstruction). This package's block/body
+		// Opening fence with no closing fence — treat as bodyless content.
-	// never included either — TrimSuffix/TrimPrefix restore that exact
+		return fm, src
-	// boundary. Split guarantees ok=true only when "\n---\n" matched, so
+	}
-	// both trims are always exactly one byte, never ambiguous.
+	block := rest[:end]
-	block := strings.TrimSuffix(string(blockBytes), "\n")
+	body := rest[end+len("\n---\n"):]
 	body := strings.TrimPrefix(string(restBytes), "\n")
 	for _, line := range strings.Split(block, "\n") {
 		// An indented line is a continuation (a YAML block-list item, a
 		// wrapped value) never a top-level key, regardless of whether it
 		// happens to contain a colon — "  - 'Chapter 3: The Reckoning'" is
 		// not a key named "- 'Chapter 3" (hyperguild#128). Checked before
 		// Cut so a colon inside one never reaches the key/value path.
 		if line != "" && (line[0] == ' ' || line[0] == '\t') {
 			fm.lines = append(fm.lines, fmLine{raw: line})
 			continue
 		}
 		key, val, ok := strings.Cut(line, ":")
 		key = strings.TrimSpace(key)
 		if !ok || key == "" || strings.HasPrefix(strings.TrimSpace(line), "#") {
@@ -105,19 +83,9 @@ func (f *frontmatter) render() string {
 	var b strings.Builder
 	b.WriteString("---\n")
 	for _, l := range f.lines {
-		switch {
+		if l.key == "" {
 		case l.key == "":
 			b.WriteString(l.raw)
-		case l.value == "":
+		} else {
 			// A key with nothing after the colon (the YAML block-list
 			// shape: "aliases:" followed by indented "- item" lines on
 			// their own raw lines) must stay bare — "key: " with a
 			// trailing space is a different byte sequence than the
 			// original, and this type's whole purpose (see the package
 			// doc) is a byte-preserving round-trip.
 			b.WriteString(l.key)
 			b.WriteByte(':')
 		default:
 			b.WriteString(l.key)
 			b.WriteString(": ")
 			b.WriteString(l.value)
@@ -59,37 +59,3 @@ func TestFrontmatterRenderRoundTrips(t *testing.T) {
 	fm, _ := parseFrontmatter(src)
 	assert.Equal(t, src, fm.render())
 }
 func TestParseFrontmatterIndentedListItemWithColonIsNotMisparsedAsKey(t *testing.T) {
 	// hyperguild#128: an indented YAML block-list item that happens to
 	// contain a colon (e.g. a title with a subtitle) is a continuation
 	// line, never a top-level key — strings.Cut doesn't know that just
 	// because TrimSpace(key) happens to be non-empty. Misparsing it as a
 	// key/value pair and re-rendering strips its indentation, de-indenting
 	// it out of the list it belongs to. Same bug class already found and
 	// fixed in the sibling internal/wiki package's parseFrontmatterBlock
 	// (hyperguild#126 review round 3) — this package was the original the
 	// reimplementation was modeled on and had the gap too.
 	src := "---\naliases:\n  - 'Chapter 3: The Reckoning'\ntitle: 'X'\n---\nbody\n"
 	fm, _ := parseFrontmatter(src)
 	fm.set("updated_at", "2026-09-23T00:00:00Z")
 	out := fm.render()
 	assert.Contains(t, out, "  - 'Chapter 3: The Reckoning'",
 		"the indented list item must survive verbatim, not get re-emitted as a de-indented fake key")
 	assert.NotContains(t, out, "\n- 'Chapter 3",
 		"must not be split into a fake key/value pair at column 0 (as opposed to surviving indented, asserted above)")
 }
 func TestFrontmatterRenderEmptyValueKeyStaysBareNoTrailingSpace(t *testing.T) {
 	// Companion to the indented-list-item fix: "aliases:" (a key with
 	// nothing after the colon, the YAML block-list header) must round-trip
 	// bare, not as "aliases: " with a trailing space — a different byte
 	// sequence than the original, breaking this type's whole reason for
 	// being a line-preserving view rather than a YAML re-marshal.
 	// render() returns only the frontmatter block (see
 	// TestFrontmatterRenderRoundTrips), no trailing body.
 	src := "---\naliases:\n  - one\n  - two\n---\n"
 	fm, _ := parseFrontmatter(src)
 	assert.Equal(t, src, fm.render())
 }
@@ -12,7 +12,7 @@ import (
 	"time"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/brain"
-	"github.com/mathiasbq/hyperguild/ingestion/internal/claim"
+	"github.com/mathiasbq/hyperguild/ingestion/internal/extract"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/pipeline"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/search"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/vectorstore"
@@ -53,6 +53,8 @@ type queryRequest struct {
 type writeRequest struct {
 	Content    string `json:"content"`
 	Filename   string `json:"filename,omitempty"`
 	Type       string `json:"type,omitempty"`
 	Domain     string `json:"domain,omitempty"`
 	Wing       string `json:"wing,omitempty"`
 	Hall       string `json:"hall,omitempty"`
 	SourceType string `json:"source_type,omitempty"` // "external" opts a hall=facts entry out of the internal default
@@ -107,21 +109,20 @@ func (h *Handler) Query(w http.ResponseWriter, r *http.Request) {
 // WriteNoteOptions configures how a brain note is written.
 //
-// Wing and Hall are both required: the note routes into the structured
+// When both Wing and Hall are non-empty, the note routes into the
-// wiki at brain/wiki/<wing>/<hall>/<slug>.md and gets wing/hall/created_at
+// structured wiki at brain/wiki/<wing>/<hall>/<slug>.md and gets
-// injected into its YAML frontmatter. There is no other valid destination
+// wing/hall/created_at injected into its YAML frontmatter.
-// (the legacy brain/knowledge/ fallback was removed — ADR-0012 / #79).
+//
 // When either is empty, the note falls back to brain/knowledge/<filename>
 // with optional type/domain frontmatter (legacy behaviour).
 type WriteNoteOptions struct {
 	Content    string
 	Filename   string
 	Type       string
 	Domain     string
 	Wing       string
 	Hall       string
 	SourceType string // "internal" marks a first-party observation (e.g. claudewatcher) that needs no external citation
 	// Origin/WrittenBy are server-owned provenance (hyperguild#145): any
 	// origin/written_by in Content's own frontmatter is discarded, so a
 	// caller cannot claim a more trusted origin than it authenticated as.
 	Origin    string
 	WrittenBy string
 }
 // WriteNote writes a markdown note into the brain. Returns the path
@@ -130,21 +131,14 @@ func WriteNote(brainDir string, opts WriteNoteOptions) (string, error) {
 	if opts.Content == "" {
 		return "", fmt.Errorf("content is required")
 	}
 	if opts.Wing == "" || opts.Hall == "" {
 		return "", fmt.Errorf("wing and hall are required")
 	}
 	// In the primitive, not in a caller: POST /write reaches here directly,
 	// without the BrainStore, and a gate one door wide is not a gate.
 	// BrainStore still calls the strip itself to report Ref.Unlinked; the
 	// second pass is a no-op on already-clean content.
 	clean, _, err := brain.StripUnresolvedLinks(brainDir, opts.Content)
 	if err != nil {
 		return "", err
 	}
 	opts.Content = clean
 	if opts.Wing != "" && opts.Hall != "" {
 		return writeHallNote(brainDir, opts)
 	}
 	if opts.Wing != "" || opts.Hall != "" {
 		return "", fmt.Errorf("wing and hall must be set together")
 	}
 	return writeLegacyNote(brainDir, opts)
 }
 // writeHallNote routes a note into brain/wiki/<wing>/<hall>/ and injects
@@ -158,21 +152,15 @@ func writeHallNote(brainDir string, opts WriteNoteOptions) (string, error) {
 	if err != nil {
 		return "", err
 	}
 	if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
 		return "", fmt.Errorf("create hall dir: %w", err)
 	}
 	existingFields, body := splitFrontmatter(opts.Content)
 	existingByKey := make(map[string]frontmatterField, len(existingFields))
 	for _, f := range existingFields {
 		existingByKey[f.key] = f
 	}
 	// Validate the claim-property envelope BEFORE creating the directory, so a
 	// rejected write leaves nothing behind — not even an empty hall dir
 	// (brain#21). Fail closed: a value outside the enum is worse than an absent
 	// one, because a lint skips what it cannot parse and the note then reads as
 	// classified while nothing acts on it.
 	if err := claim.ValidateEnvelope(scalarValues(existingFields)); err != nil {
 		return "", fmt.Errorf("claim envelope: %w", err)
 	}
 	emitted := make(map[string]bool, 6)
 	var fm strings.Builder
@@ -199,6 +187,9 @@ func writeHallNote(brainDir string, opts WriteNoteOptions) (string, error) {
 			fmt.Fprintf(&fm, "%s: %s\n", key, fallback)
 		}
 	}
 	writeField("type", opts.Type)
 	writeField("domain", opts.Domain)
 	sourceType := opts.SourceType
 	if sourceType == "" && opts.Hall == "facts" {
 		// Most hall=facts entries are first-party (an eval/benchmark the
@@ -220,42 +211,13 @@ func writeHallNote(brainDir string, opts WriteNoteOptions) (string, error) {
 	}
 	fm.WriteString("---\n")
-	final, err := StampProvenance(fm.String()+body, opts.Origin, opts.WrittenBy)
+	if err := os.WriteFile(dest, []byte(fm.String()+body), 0o644); err != nil {
 	if err != nil {
 		return "", err
 	}
 	// The directory is created only once the note is known to be writable:
 	// a refused write leaves nothing behind, not even an empty hall dir
 	// (brain#21; provenance refusal joins the envelope refusal here).
 	if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
 		return "", fmt.Errorf("create hall dir: %w", err)
 	}
 	if err := os.WriteFile(dest, []byte(final), 0o644); err != nil {
 		return "", fmt.Errorf("write: %w", err)
 	}
 	rel, _ := filepath.Rel(brainDir, dest)
 	return filepath.ToSlash(rel), nil
 }
 // scalarValues flattens frontmatter fields to key -> scalar value for
 // validation. Multi-line values (lists, nested blocks) yield the text after
 // the colon on the first line, which is empty for a list — correct here,
 // since every claim-property field is a scalar enum.
 func scalarValues(fields []frontmatterField) map[string]string {
 	out := make(map[string]string, len(fields))
 	for _, f := range fields {
 		if len(f.lines) == 0 {
 			continue
 		}
 		_, value, found := strings.Cut(f.lines[0], ":")
 		if !found {
 			continue
 		}
 		out[f.key] = strings.TrimSpace(value)
 	}
 	return out
 }
 // frontmatterField is one top-level YAML key from a frontmatter block,
 // along with its raw line and any indented continuation lines (e.g. a
 // bulleted list value spanning multiple lines).
@@ -299,33 +261,70 @@ func splitFrontmatter(content string) (fields []frontmatterField, body string) {
 	return fields, body
 }
-// Write handles POST /write — write a note into brain/wiki/<wing>/<hall>/.
+// writeLegacyNote preserves the original brain/knowledge/ behaviour for
 // callers that have not adopted the wing/hall taxonomy.
 func writeLegacyNote(brainDir string, opts WriteNoteOptions) (string, error) {
 	filename := opts.Filename
 	if filename == "" {
 		filename = fmt.Sprintf("%s-auto.md", time.Now().UTC().Format("2006-01-02-150405"))
 	}
 	rawDir := filepath.Join(brainDir, "knowledge")
 	if err := os.MkdirAll(rawDir, 0o755); err != nil {
 		return "", fmt.Errorf("create raw dir: %w", err)
 	}
 	finalContent := opts.Content
 	if opts.Type != "" || opts.Domain != "" {
 		var fm strings.Builder
 		fm.WriteString("---\n")
 		if opts.Type != "" {
 			fmt.Fprintf(&fm, "type: %s\n", opts.Type)
 		}
 		if opts.Domain != "" {
 			fmt.Fprintf(&fm, "domain: %s\n", opts.Domain)
 		}
 		fm.WriteString("---\n")
 		finalContent = fm.String() + opts.Content
 	}
 	if strings.ContainsAny(filename, `/\`) {
 		return "", fmt.Errorf("invalid filename")
 	}
 	base := filepath.Base(filename)
 	if base == "." || base == ".." || base == "" {
 		return "", fmt.Errorf("invalid filename")
 	}
 	if !strings.HasSuffix(base, ".md") {
 		base += ".md"
 	}
 	dest := filepath.Join(rawDir, base)
 	if err := os.WriteFile(dest, []byte(finalContent), 0o644); err != nil {
 		return "", fmt.Errorf("write: %w", err)
 	}
 	rel, _ := filepath.Rel(brainDir, dest)
 	return filepath.ToSlash(rel), nil
 }
 // Write handles POST /write — write raw content to brain/knowledge/.
 func (h *Handler) Write(w http.ResponseWriter, r *http.Request) {
 	var req writeRequest
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		writeError(w, http.StatusBadRequest, "invalid JSON")
 		return
 	}
-	// Field by field, not a struct conversion: provenance is server-owned and
+	relPath, err := WriteNote(h.brainDir, WriteNoteOptions(req))
 	// this door carries no principal, so it stamps origin: unknown
 	// (hyperguild#145). A JSON body must never be able to set it.
 	relPath, err := WriteNote(h.brainDir, WriteNoteOptions{
 		Content:    req.Content,
 		Filename:   req.Filename,
 		Wing:       req.Wing,
 		Hall:       req.Hall,
 		SourceType: req.SourceType,
 	})
 	if err != nil {
 		h.logger.Error("write failed", "err", err)
 		writeError(w, http.StatusBadRequest, err.Error())
 		return
 	}
-	// WriteNote errors out above unless both are set, so this always runs —
+	if req.Wing != "" && req.Hall != "" {
 	// no legacy fallback path left to guard against.
 		if err := brain.BuildWingIndex(h.brainDir, req.Wing); err != nil {
 			h.logger.Warn("auto-index failed", "wing", req.Wing, "err", err)
 		}
 	}
 	writeJSON(w, map[string]string{"path": relPath})
 }
@@ -446,12 +445,6 @@ func (h *Handler) IngestPath(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, "path is required")
 		return
 	}
 	resolved, err := ResolveIngestPath(h.brainDir, req.Path)
 	if err != nil {
 		writeError(w, http.StatusBadRequest, err.Error())
 		return
 	}
 	req.Path = resolved
 	info, err := os.Stat(req.Path)
 	if err != nil {
@@ -474,13 +467,7 @@ func (h *Handler) IngestPath(w http.ResponseWriter, r *http.Request) {
 			if !isSupportedExtension(ext) {
 				return nil
 			}
-			// Each walked file is re-resolved: a symlinked file inside raw/
+			content, readErr := extract.Text(path)
 			// would otherwise lead extract.Text out of the inbox (#149).
 			if _, rerr := ResolveIngestPath(h.brainDir, path); rerr != nil {
 				allWarnings = append(allWarnings, fmt.Sprintf("skipped %s: %v", path, rerr))
 				return nil
 			}
 			content, readErr := ReadIngestFile(h.brainDir, path)
 			if readErr != nil {
 				allWarnings = append(allWarnings, fmt.Sprintf("extract %s: %v", path, readErr))
 				return nil
@@ -509,7 +496,7 @@ func (h *Handler) IngestPath(w http.ResponseWriter, r *http.Request) {
 			writeError(w, http.StatusBadRequest, fmt.Sprintf("unsupported file extension: %s", ext))
 			return
 		}
-		content, readErr := ReadIngestFile(h.brainDir, req.Path)
+		content, readErr := extract.Text(req.Path)
 		if readErr != nil {
 			writeError(w, http.StatusInternalServerError, fmt.Sprintf("extract text: %v", readErr))
 			return
@@ -561,8 +548,7 @@ func (h *Handler) IngestRaw(w http.ResponseWriter, r *http.Request) {
 		return
 	}
-	// No principal on this door: pages are stamped origin: unknown (#145).
+	result, err := pipeline.RunRaw(h.brainDir, req.Source, req.Pages, req.DryRun)
 	result, err := pipeline.RunRaw(r.Context(), h.brainDir, req.Source, req.Pages, req.DryRun)
 	if err != nil {
 		h.logger.Error("ingest-raw failed", "source", req.Source, "err", err)
 		writeError(w, http.StatusInternalServerError, "ingest error")
@@ -618,11 +604,7 @@ func (h *Handler) Promote(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusBadRequest, "invalid JSON")
 		return
 	}
-	// Field by field: this door carries no principal, so the promoted note is
+	rel, err := PromoteNote(h.brainDir, PromoteOptions(req))
 	// stamped origin: unknown and the body cannot set provenance (#145).
 	rel, err := PromoteNote(h.brainDir, PromoteOptions{
 		Filename: req.Filename, Wing: req.Wing, Hall: req.Hall, Slug: req.Slug,
 	})
 	if err != nil {
 		writeError(w, http.StatusBadRequest, err.Error())
 		return
@@ -65,13 +65,11 @@ func TestQuery_ReturnsResults(t *testing.T) {
 	assert.NotEmpty(t, results)
 }
-func TestWrite_CreatesWikiFile(t *testing.T) {
+func TestWrite_CreatesKnowledgeFile(t *testing.T) {
 	dir, h := setup(t)
 	body, _ := json.Marshal(map[string]any{
 		"content":  "# Test note\n\nSome content.",
-		"filename": "test-note",
+		"filename": "test-note.md",
 		"wing":     "homelab",
 		"hall":     "facts",
 	})
 	req := httptest.NewRequest(http.MethodPost, "/write", bytes.NewReader(body))
 	rec := httptest.NewRecorder()
@@ -83,25 +81,11 @@ func TestWrite_CreatesWikiFile(t *testing.T) {
 	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &resp))
 	assert.NotEmpty(t, resp["path"])
-	content, err := os.ReadFile(filepath.Join(dir, "wiki", "homelab", "facts", "test-note.md"))
+	content, err := os.ReadFile(filepath.Join(dir, "knowledge", "test-note.md"))
 	require.NoError(t, err)
 	assert.Contains(t, string(content), "Some content.")
 }
 // TestWrite_RequiresWingAndHall is the HTTP-contract counterpart of
 // TestWriteNote_RequiresWingAndHall: a caller (e.g. the MCP brain_write
 // handler) that omits wing/hall gets a 400, not a silent legacy write.
 func TestWrite_RequiresWingAndHall(t *testing.T) {
 	_, h := setup(t)
 	body, _ := json.Marshal(map[string]any{"content": "no destination"})
 	req := httptest.NewRequest(http.MethodPost, "/write", bytes.NewReader(body))
 	rec := httptest.NewRecorder()
 	h.Write(rec, req)
 	assert.Equal(t, http.StatusBadRequest, rec.Code)
 }
 func TestQuery_RequiresQuery(t *testing.T) {
 	_, h := setup(t)
 	body, _ := json.Marshal(map[string]any{"limit": 5})
@@ -113,6 +97,27 @@ func TestQuery_RequiresQuery(t *testing.T) {
 	assert.Equal(t, http.StatusBadRequest, rec.Code)
 }
 func TestWrite_IncludesFrontmatterWhenTypeProvided(t *testing.T) {
 	dir, h := setup(t)
 	body, _ := json.Marshal(map[string]any{
 		"content":  "Some learning.",
 		"filename": "typed-note.md",
 		"type":     "concept",
 		"domain":   "software",
 	})
 	req := httptest.NewRequest(http.MethodPost, "/write", bytes.NewReader(body))
 	rec := httptest.NewRecorder()
 	h.Write(rec, req)
 	assert.Equal(t, http.StatusOK, rec.Code)
 	content, err := os.ReadFile(filepath.Join(dir, "knowledge", "typed-note.md"))
 	require.NoError(t, err)
 	assert.Contains(t, string(content), "type: concept")
 	assert.Contains(t, string(content), "domain: software")
 	assert.Contains(t, string(content), "Some learning.")
 }
 func TestWriteNote_HallRouteIncludesSourceTypeWhenSet(t *testing.T) {
 	dir := t.TempDir()
@@ -121,6 +126,7 @@ func TestWriteNote_HallRouteIncludesSourceTypeWhenSet(t *testing.T) {
 		Filename:   "session-koala-abc",
 		Wing:       "claude-sessions",
 		Hall:       "facts",
 		Type:       "source",
 		SourceType: "internal",
 	})
 	require.NoError(t, err)
@@ -204,95 +210,37 @@ func TestWriteNote_HallRouteMergesExistingFrontmatterInsteadOfStacking(t *testin
 	assert.Contains(t, body, "# Body")
 }
-// TestWriteNote_RequiresWingAndHall pins the post-legacy-removal contract
+func TestWriteNote_HallRouteExistingTypeWinsOverOptsType(t *testing.T) {
 // (hyperguild#79 / ADR-0012): with the knowledge/ fallback gone, wing+hall
 // is the only valid destination, so omitting either is a caller error, not
 // a silent fallback.
 func TestWriteNote_RequiresWingAndHall(t *testing.T) {
 	cases := []struct {
 		name string
 		wing string
 		hall string
 	}{
 		{"neither set", "", ""},
 		{"wing only", "homelab", ""},
 		{"hall only", "", "facts"},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 	dir := t.TempDir()
-			_, err := api.WriteNote(dir, api.WriteNoteOptions{
+
-				Content: "body",
+	rel, err := api.WriteNote(dir, api.WriteNoteOptions{
-				Wing:    tc.wing,
+		Content:  "---\ntype: hypothesis\n---\n\nBody.\n",
-				Hall:    tc.hall,
+		Filename: "note",
 		Wing:     "agentsquad",
 		Hall:     "decisions",
 		Type:     "decision", // should lose to content's own "type: hypothesis"
 	})
-			require.Error(t, err)
+	require.NoError(t, err)
-			assert.Contains(t, err.Error(), "wing and hall are required")
+
-		})
+	got, err := os.ReadFile(filepath.Join(dir, filepath.FromSlash(rel)))
-	}
+	require.NoError(t, err)
 	assert.Contains(t, string(got), "type: hypothesis")
 	assert.NotContains(t, string(got), "type: decision")
 }
 func TestWrite_GeneratesFilenameIfAbsent(t *testing.T) {
 	dir, h := setup(t)
-	body, _ := json.Marshal(map[string]any{
+	body, _ := json.Marshal(map[string]any{"content": "auto name"})
 		"content": "auto name",
 		"wing":    "homelab",
 		"hall":    "facts",
 	})
 	req := httptest.NewRequest(http.MethodPost, "/write", bytes.NewReader(body))
 	rec := httptest.NewRecorder()
 	h.Write(rec, req)
 	assert.Equal(t, http.StatusOK, rec.Code)
-	entries, err := os.ReadDir(filepath.Join(dir, "wiki", "homelab", "facts"))
+	entries, _ := os.ReadDir(filepath.Join(dir, "knowledge"))
-	require.NoError(t, err)
+	// +1 because setup already wrote tdd.md
-	require.Len(t, entries, 1)
+	assert.Len(t, entries, 2)
-	assert.True(t, strings.HasSuffix(entries[0].Name(), ".md"))
+	assert.True(t, strings.HasSuffix(entries[1].Name(), ".md"))
 }
 // TestWrite_CLIPayloadRoundTrips exercises the real Handler.Write (not a
 // hand-rolled mock) over an actual HTTP round trip, POSTing the exact JSON
 // envelope cmd/hyperguild's brainClient.Write sends: {wing, hall, filename,
 // content}. cmd/hyperguild lives in a separate Go module from ingestion
 // (no shared go.work), so a Go-level test can't import brainClient
 // directly — this test instead pins the wire contract from the server
 // side and proves a real `hyperguild brain write <wing> <hall> <slug>`
 // invocation writes a real file with real frontmatter under wiki/<wing>/<hall>/.
 // A prior version of this contract test on the client side (in
 // cmd/hyperguild/http_test.go) used only an httptest.NewServer with a
 // hand-rolled mock body, so it stayed green through a regression where the
 // server required wing/hall but the client never sent them (hyperguild#79
 // PR review).
 func TestWrite_CLIPayloadRoundTrips(t *testing.T) {
 	dir, h := setup(t)
 	srv := httptest.NewServer(http.HandlerFunc(h.Write))
 	defer srv.Close()
 	payload, err := json.Marshal(struct {
 		Wing     string `json:"wing"`
 		Hall     string `json:"hall"`
 		Filename string `json:"filename"`
 		Content  string `json:"content"`
 	}{Wing: "homelab", Hall: "facts", Filename: "cli-roundtrip", Content: "# CLI roundtrip\n\nReal write.\n"})
 	require.NoError(t, err)
 	resp, err := http.Post(srv.URL+"/write", "application/json", bytes.NewReader(payload)) //nolint:noctx
 	require.NoError(t, err)
 	defer resp.Body.Close() //nolint:errcheck
 	assert.Equal(t, http.StatusOK, resp.StatusCode)
 	var out struct {
 		Path string `json:"path"`
 	}
 	require.NoError(t, json.NewDecoder(resp.Body).Decode(&out))
 	assert.Equal(t, "wiki/homelab/facts/cli-roundtrip.md", out.Path)
 	written, err := os.ReadFile(filepath.Join(dir, "wiki", "homelab", "facts", "cli-roundtrip.md"))
 	require.NoError(t, err)
 	assert.Contains(t, string(written), "wing: homelab")
 	assert.Contains(t, string(written), "hall: facts")
 	assert.Contains(t, string(written), "Real write.")
 }
 // ---------------------------------------------------------------------------
@@ -361,11 +309,10 @@ func TestIngestPath_MissingPath(t *testing.T) {
 }
 func TestIngestPath_File(t *testing.T) {
-	brainDir, h := setup(t)
+	_, h := setup(t)
 	// Create a temp file with content
-	dir := filepath.Join(brainDir, "raw", "fixture") // ingest paths must live in brain/raw/ (#149)
+	dir := t.TempDir()
 	require.NoError(t, os.MkdirAll(dir, 0o755))
 	f := filepath.Join(dir, "doc.md")
 	require.NoError(t, os.WriteFile(f, []byte("# Hello\nThis is markdown content."), 0o644))
@@ -469,11 +416,10 @@ func TestIngestRaw_DryRun(t *testing.T) {
 }
 func TestIngestPath_Directory(t *testing.T) {
-	brainDir, h := setup(t)
+	_, h := setup(t)
 	// Create a temp dir with one .md file
-	dir := filepath.Join(brainDir, "raw", "fixture") // ingest paths must live in brain/raw/ (#149)
+	dir := t.TempDir()
 	require.NoError(t, os.MkdirAll(dir, 0o755))
 	require.NoError(t, os.WriteFile(filepath.Join(dir, "notes.md"), []byte("# Notes\nSome notes."), 0o644))
 	body, _ := json.Marshal(map[string]any{
@@ -494,102 +440,3 @@ func TestIngestPath_Directory(t *testing.T) {
 	require.True(t, ok, "pages must be an array")
 	assert.NotEmpty(t, pagesSlice)
 }
 // --- brain#21: claim-property envelope on the write path -------------------
 func TestWriteNote_PreservesClaimEnvelopeVerbatim(t *testing.T) {
 	// writeHallNote already passes unknown keys through; this pins that
 	// behaviour for the envelope specifically, so a future refactor of the
 	// merge loop cannot silently drop it.
 	dir := t.TempDir()
 	rel, err := api.WriteNote(dir, api.WriteNoteOptions{
 		Content: "---\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\n\nA durable claim.\n",
 		Wing:    "homelab",
 		Hall:    "decisions",
 	})
 	require.NoError(t, err)
 	got, err := os.ReadFile(filepath.Join(dir, filepath.FromSlash(rel)))
 	require.NoError(t, err)
 	assert.Contains(t, string(got), "half_life: durable")
 	assert.Contains(t, string(got), "applies: universal")
 	assert.Contains(t, string(got), "claim_provenance: asserted")
 }
 func TestWriteNote_RejectsInvalidClaimEnvelopeAndWritesNothing(t *testing.T) {
 	// Fail closed: a value outside the enum must not land. A lint skips what
 	// it cannot parse, so an unvalidated write produces a note that reads as
 	// classified while nothing acts on it.
 	dir := t.TempDir()
 	_, err := api.WriteNote(dir, api.WriteNoteOptions{
 		Content:  "---\nhalf_life: forever\nclaim_provenance: asserted\n---\n\nBody.\n",
 		Filename: "bad-envelope",
 		Wing:     "homelab",
 		Hall:     "facts",
 	})
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "half_life")
 	_, statErr := os.Stat(filepath.Join(dir, "wiki/homelab/facts/bad-envelope.md"))
 	assert.True(t, os.IsNotExist(statErr), "a rejected write must leave no file behind")
 }
 func TestWriteNote_RejectsClaimFieldWithoutProvenance(t *testing.T) {
 	dir := t.TempDir()
 	_, err := api.WriteNote(dir, api.WriteNoteOptions{
 		Content:  "---\napplies: homelab\n---\n\nBody.\n",
 		Filename: "no-provenance",
 		Wing:     "homelab",
 		Hall:     "facts",
 	})
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "claim_provenance")
 	_, statErr := os.Stat(filepath.Join(dir, "wiki/homelab/facts/no-provenance.md"))
 	assert.True(t, os.IsNotExist(statErr))
 }
 // The HTTP POST /write door reaches WriteNote directly, without the
 // BrainStore, so the unresolved-wikilink strip has to live in the primitive
 // or that door stays ungated.
 func TestWriteNote_UnwrapsUnresolvedWikilinks(t *testing.T) {
 	dir := t.TempDir()
 	_, err := api.WriteNote(dir, api.WriteNoteOptions{
 		Content: "# Target\n\nbody\n", Filename: "target", Wing: "a", Hall: "facts",
 	})
 	require.NoError(t, err)
 	rel, err := api.WriteNote(dir, api.WriteNoteOptions{
 		Content:  "See [[target]] and [[gitea-ci]].\n",
 		Filename: "src", Wing: "a", Hall: "facts",
 	})
 	require.NoError(t, err)
 	got, err := os.ReadFile(filepath.Join(dir, filepath.FromSlash(rel)))
 	require.NoError(t, err)
 	assert.Contains(t, string(got), "[[target]]")
 	assert.Contains(t, string(got), "and gitea-ci.")
 	assert.NotContains(t, string(got), "[[gitea-ci]]")
 }
 func TestUpdateNote_UnwrapsUnresolvedWikilinks(t *testing.T) {
 	dir := t.TempDir()
 	_, err := api.WriteNote(dir, api.WriteNoteOptions{
 		Content: "old\n", Filename: "n", Wing: "a", Hall: "facts",
 	})
 	require.NoError(t, err)
 	rel, _, _, err := api.UpdateNote(dir, api.UpdateNoteOptions{
 		Wing: "a", Hall: "facts", Slug: "n",
 		Content: "Related: [[secret-hygiene]].\n", Reason: "r",
 	})
 	require.NoError(t, err)
 	got, err := os.ReadFile(filepath.Join(dir, filepath.FromSlash(rel)))
 	require.NoError(t, err)
 	assert.Contains(t, string(got), "Related: secret-hygiene.")
 	assert.NotContains(t, string(got), "[[secret-hygiene]]")
 }
@@ -40,10 +40,9 @@ func TestIngestPath_DocxSupportedWhenDocmarkConfigured(t *testing.T) {
 	t.Setenv("DOCMARK_URL", srv.URL+"/mcp")
 	t.Setenv("DOCMARK_BEARER_TOKEN", "tok")
-	brainDir, h := setup(t)
+	_, h := setup(t)
-	dir := filepath.Join(brainDir, "raw", "fixture") // ingest paths must live in brain/raw/ (#149)
+	dir := t.TempDir()
 	require.NoError(t, os.MkdirAll(dir, 0o755))
 	f := filepath.Join(dir, "doc.docx")
 	require.NoError(t, os.WriteFile(f, []byte("fake docx"), 0o644))
@@ -1,67 +0,0 @@
 package api
 import (
 	"errors"
 	"os"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/extract"
 	"path/filepath"
 	"strings"
 )
 // ErrOutsideIngestRoot is the one refusal for every bad ingest path. It never
 // carries the underlying error: "no such file" versus "permission denied"
 // would let a caller probe which server files exist (PR #152 review).
 var ErrOutsideIngestRoot = errors.New("ingest path must be an existing file or directory inside brain/raw/")
 // ResolveIngestPath confines a caller-supplied ingest path to brain/raw/, the
 // inbox the watcher already owns (hyperguild#149). Relative paths resolve
 // against that root; symlinks are evaluated before the containment check, so
 // a link inside raw/ that points elsewhere is refused. The path must exist.
 func ResolveIngestPath(brainDir, p string) (string, error) {
 	if strings.TrimSpace(p) == "" {
 		return "", ErrOutsideIngestRoot
 	}
 	// raw/ itself must be a real directory: if it were a symlink, containment
 	// inside it would mean nothing (hyperguild#153 item 4).
 	if fi, lerr := os.Lstat(filepath.Join(brainDir, "raw")); lerr != nil || fi.Mode()&os.ModeSymlink != 0 || !fi.IsDir() {
 		return "", ErrOutsideIngestRoot
 	}
 	root, err := filepath.EvalSymlinks(filepath.Join(brainDir, "raw"))
 	if err != nil {
 		return "", ErrOutsideIngestRoot
 	}
 	if !filepath.IsAbs(p) {
 		p = filepath.Join(root, p)
 	}
 	real, err := filepath.EvalSymlinks(filepath.Clean(p))
 	if err != nil {
 		return "", ErrOutsideIngestRoot
 	}
 	rel, err := filepath.Rel(root, real)
 	if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) || filepath.IsAbs(rel) {
 		return "", ErrOutsideIngestRoot
 	}
 	return real, nil
 }
 // ReadIngestFile extracts text from an ingest path already confined by
 // ResolveIngestPath, reading it through the raw/ root rather than reopening
 // the path by name (hyperguild#153 item 3): if the file is swapped for a
 // symlink after the check, the read still cannot leave raw/.
 func ReadIngestFile(brainDir, resolved string) (string, error) {
 	root, rawPath, err := OpenRawRoot(brainDir)
 	if err != nil {
 		return "", ErrOutsideIngestRoot
 	}
 	defer func() { _ = root.Close() }()
 	realRoot, err := filepath.EvalSymlinks(rawPath)
 	if err != nil {
 		return "", ErrOutsideIngestRoot
 	}
 	rel, err := filepath.Rel(realRoot, resolved)
 	if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) || filepath.IsAbs(rel) {
 		return "", ErrOutsideIngestRoot
 	}
 	return extract.TextIn(root, rel)
 }
@@ -1,88 +0,0 @@
 package api_test
 import (
 	"bytes"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
 )
 // hyperguild#149: /ingest-path and MCP brain_ingest read a caller-chosen
 // server path, so any file the pod could read (the ServiceAccount token,
 // /etc/passwd) could be pulled into the brain and read back out. Ingest paths
 // now resolve inside brain/raw/ — the inbox the watcher already owns — with
 // symlinks evaluated, or are refused.
 func TestResolveIngestPathConfinesToRawInbox(t *testing.T) {
 	brain := t.TempDir()
 	raw := filepath.Join(brain, "raw")
 	require.NoError(t, os.MkdirAll(filepath.Join(raw, "sub"), 0o755))
 	require.NoError(t, os.WriteFile(filepath.Join(raw, "sub", "ok.md"), []byte("x"), 0o644))
 	outside := filepath.Join(t.TempDir(), "secret.txt")
 	require.NoError(t, os.WriteFile(outside, []byte("s"), 0o644))
 	require.NoError(t, os.Symlink(outside, filepath.Join(raw, "link.md")))
 	require.NoError(t, os.Symlink(filepath.Dir(outside), filepath.Join(raw, "dirlink")))
 	for _, ok := range []string{filepath.Join(raw, "sub", "ok.md"), "sub/ok.md", raw, "sub"} {
 		_, err := api.ResolveIngestPath(brain, ok)
 		assert.NoError(t, err, ok)
 	}
 	for _, bad := range []string{
 		"/etc/hostname", outside, "../secret.txt", filepath.Join(raw, "..", "wiki"),
 		filepath.Join(raw, "link.md"), filepath.Join(raw, "dirlink", "secret.txt"),
 		raw + "-evil/x.md", "",
 	} {
 		_, err := api.ResolveIngestPath(brain, bad)
 		assert.Error(t, err, "must refuse %q", bad)
 	}
 }
 func TestIngestPathRefusesAPathOutsideTheInbox(t *testing.T) {
 	_, h := setup(t)
 	body, _ := json.Marshal(map[string]any{"path": "/etc/hostname"})
 	rec := httptest.NewRecorder()
 	h.IngestPath(rec, httptest.NewRequest(http.MethodPost, "/ingest-path", bytes.NewReader(body)))
 	assert.Equal(t, http.StatusBadRequest, rec.Code)
 	assert.Contains(t, rec.Body.String(), "raw")
 }
 // A directory ingest must not follow a symlinked FILE inside raw/ out of it.
 func TestIngestPathDirectoryWalkSkipsSymlinksLeavingTheInbox(t *testing.T) {
 	dir, h := setup(t)
 	raw := filepath.Join(dir, "raw", "batch")
 	require.NoError(t, os.MkdirAll(raw, 0o755))
 	outside := filepath.Join(t.TempDir(), "secret.md")
 	require.NoError(t, os.WriteFile(outside, []byte("# secret\n\nSENTINEL-149-OUTSIDE"), 0o644))
 	require.NoError(t, os.Symlink(outside, filepath.Join(raw, "leak.md")))
 	body, _ := json.Marshal(map[string]any{"path": "batch", "source": "walk"})
 	rec := httptest.NewRecorder()
 	h.IngestPath(rec, httptest.NewRequest(http.MethodPost, "/ingest-path", bytes.NewReader(body)))
 	assert.Contains(t, rec.Body.String(), "skipped")
 	assert.NotContains(t, rec.Body.String(), "SENTINEL-149-OUTSIDE")
 }
 // PR #152 review: the raw EvalSymlinks error told an authenticated caller
 // whether any server file existed ("no such file") or was unreadable
 // ("permission denied"), and leaked the brain directory. Every refusal now
 // reads the same.
 func TestResolveIngestPathRefusalsAreIndistinguishable(t *testing.T) {
 	brain := t.TempDir()
 	require.NoError(t, os.MkdirAll(filepath.Join(brain, "raw"), 0o755))
 	var msgs []string
 	for _, p := range []string{"/etc/hostname", "/etc/definitely-not-here-149", "../x", "nope/missing.md", ""} {
 		_, err := api.ResolveIngestPath(brain, p)
 		require.Error(t, err, p)
 		msgs = append(msgs, err.Error())
 		assert.NotContains(t, err.Error(), brain, "refusal for %q leaks the brain dir", p)
 	}
 	for _, m := range msgs[1:] {
 		assert.Equal(t, msgs[0], m)
 	}
 }
@@ -1,9 +1,7 @@
 package api
 import (
 	"errors"
 	"fmt"
 	"io/fs"
 	"os"
 	"path/filepath"
 	"regexp"
@@ -30,25 +28,25 @@ var datePrefix = regexp.MustCompile(`^\d{4}-\d{2}-\d{2}-`)
 // (natural review order). An absent raw/ dir yields an empty slice, not an
 // error. Only .md files are listed; tunnel-candidate files are skipped.
 func ListPending(brainDir string) ([]PendingNote, error) {
-	root, _, err := OpenRawRoot(brainDir)
+	dir := filepath.Join(brainDir, "raw")
 	entries, err := os.ReadDir(dir)
 	if err != nil {
-		if errors.Is(err, os.ErrNotExist) {
+		if os.IsNotExist(err) {
 			return []PendingNote{}, nil
 		}
 		return nil, fmt.Errorf("read raw dir: %w", err)
 	}
 	defer func() { _ = root.Close() }()
 	entries, err := fs.ReadDir(root.FS(), ".")
 	if err != nil {
 		return nil, fmt.Errorf("read raw dir: %w", err)
 	}
 	out := make([]PendingNote, 0, len(entries))
 	for _, e := range entries {
-		if !e.Type().IsRegular() || !strings.HasSuffix(e.Name(), ".md") || strings.HasPrefix(e.Name(), "tunnel-candidates-") {
+		if e.IsDir() || !strings.HasSuffix(e.Name(), ".md") || strings.HasPrefix(e.Name(), "tunnel-candidates-") {
-			continue // directories, and symlinks whose target may be anywhere (#153)
+			continue
 		}
-		raw, info, readErr := readRawNote(root, e.Name())
+		info, statErr := e.Info()
 		if statErr != nil {
 			continue
 		}
 		raw, readErr := os.ReadFile(filepath.Join(dir, e.Name()))
 		if readErr != nil {
 			continue
 		}
@@ -74,10 +72,6 @@ type PromoteOptions struct {
 	Wing     string
 	Hall     string
 	Slug     string // optional; defaults to Filename minus date prefix + .md
 	// Origin/WrittenBy re-attribute the promoted note to the promoter: the raw
 	// note's own frontmatter claims are not provenance (hyperguild#145).
 	Origin    string
 	WrittenBy string
 }
 // PromoteNote moves a note from brain/raw/ into the structured wiki: it
@@ -107,9 +101,12 @@ func PromoteNote(brainDir string, opts PromoteOptions) (string, error) {
 	}
 	src := filepath.Join(brainDir, "raw", base)
-	raw, err := readRawSource(brainDir, base)
+	raw, err := os.ReadFile(src)
 	if err != nil {
-		return "", err
+		if os.IsNotExist(err) {
 			return "", fmt.Errorf("pending note %q does not exist in raw/", base)
 		}
 		return "", fmt.Errorf("read source: %w", err)
 	}
 	// Collision: never silently overwrite an existing promoted note.
@@ -131,11 +128,7 @@ func PromoteNote(brainDir string, opts PromoteOptions) (string, error) {
 		return "", fmt.Errorf("create wing dir: %w", err)
 	}
 	// Write-then-delete: the source survives any write failure.
-	promoted, err := StampProvenance(fm.render()+body, opts.Origin, opts.WrittenBy)
+	if err := os.WriteFile(dest, []byte(fm.render()+body), 0o644); err != nil {
 	if err != nil {
 		return "", err
 	}
 	if err := os.WriteFile(dest, []byte(promoted), 0o644); err != nil {
 		return "", fmt.Errorf("write promoted note: %w", err)
 	}
 	if err := os.Remove(src); err != nil {
@@ -152,65 +145,6 @@ func PromoteNote(brainDir string, opts PromoteOptions) (string, error) {
 	return relSlash, nil
 }
 // RejectOptions identifies a raw note to reject and why.
 type RejectOptions struct {
 	Filename string // basename in brain/raw/
 	Reason   string // optional
 }
 // RejectNote records a human decision not to promote a brain/raw/ note,
 // without silently losing it: it stamps rejected_at (+ reject_reason when
 // given) into frontmatter and moves the file to brain/raw/rejected/, using
 // the same write-then-delete safety PromoteNote uses — the source survives
 // any write failure — and the same basename-only filename validation.
 //
 // A rejected note never entered the wiki, so no index rebuild or
 // auto-tunnel run: unlike PromoteNote, this is the end of the note's
 // journey, not the start of a new one. It stays out of ListPending's view
 // (raw/rejected/ is a subdirectory, and ListPending's os.ReadDir on raw/
 // does not recurse), so a rejected note is never re-surfaced as pending —
 // the human decision, once made, stays made, the same principle behind
 // this estate's "issue status is surfaced, not auto-closed, but once a
 // human decides, the decision is recorded" rule applied one level earlier.
 func RejectNote(brainDir string, opts RejectOptions) (string, error) {
 	base := filepath.Base(opts.Filename)
 	if base != opts.Filename || base == "." || base == ".." || strings.ContainsAny(opts.Filename, `/\`) {
 		return "", fmt.Errorf("invalid filename %q", opts.Filename)
 	}
 	src := filepath.Join(brainDir, "raw", base)
 	raw, err := readRawSource(brainDir, base)
 	if err != nil {
 		return "", err
 	}
 	dest := filepath.Join(brainDir, "raw", "rejected", base)
 	if _, statErr := os.Stat(dest); statErr == nil {
 		rel, _ := filepath.Rel(brainDir, dest)
 		return "", fmt.Errorf("a rejected note named %s already exists", filepath.ToSlash(rel))
 	}
 	fm, body := parseFrontmatter(string(raw))
 	fm.set("rejected_at", time.Now().UTC().Format(time.RFC3339))
 	if opts.Reason != "" {
 		fm.set("reject_reason", opts.Reason)
 	}
 	if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
 		return "", fmt.Errorf("create rejected dir: %w", err)
 	}
 	// Write-then-delete: the source survives any write failure.
 	if err := os.WriteFile(dest, []byte(fm.render()+body), 0o644); err != nil {
 		return "", fmt.Errorf("write rejected note: %w", err)
 	}
 	if err := os.Remove(src); err != nil {
 		return "", fmt.Errorf("rejected note written but source removal failed: %w", err)
 	}
 	rel, _ := filepath.Rel(brainDir, dest)
 	return filepath.ToSlash(rel), nil
 }
 // excerpt returns the first n runes of s, trimmed, single-spaced.
 func excerpt(s string, n int) string {
 	s = strings.TrimSpace(s)
@@ -220,24 +154,3 @@ func excerpt(s string, n int) string {
 	}
 	return strings.TrimSpace(string(r))
 }
 // readRawSource reads a pending note for promote/reject through the raw root,
 // refusing symlinks and a symlinked raw/ (hyperguild#153).
 func readRawSource(brainDir, base string) ([]byte, error) {
 	root, _, err := OpenRawRoot(brainDir)
 	if err != nil {
 		if errors.Is(err, os.ErrNotExist) {
 			return nil, fmt.Errorf("pending note %q does not exist in raw/", base)
 		}
 		return nil, fmt.Errorf("read source: %w", err)
 	}
 	defer func() { _ = root.Close() }()
 	raw, _, err := readRawNote(root, base)
 	if err != nil {
 		if errors.Is(err, os.ErrNotExist) {
 			return nil, fmt.Errorf("pending note %q does not exist in raw/", base)
 		}
 		return nil, fmt.Errorf("read source: %w", err)
 	}
 	return raw, nil
 }
@@ -119,85 +119,3 @@ func TestPromoteRebuildsWingIndex(t *testing.T) {
 	require.NoError(t, err, "wing _index regenerated")
 	assert.Contains(t, string(idx), "x", "promoted note appears in the index")
 }
 // --- RejectNote (hyperguild#81) ---------------------------------------------
 func TestRejectHappyPath(t *testing.T) {
 	dir := t.TempDir()
 	writeRaw(t, dir, "2026-04-23-fed-sentiment-scrape.md",
 		"---\ncreated_at: 2026-04-23T13:20:07Z\n---\n# Sentiment scrape\n\nbody.\n")
 	rel, err := RejectNote(dir, RejectOptions{
 		Filename: "2026-04-23-fed-sentiment-scrape.md", Reason: "generic scrape, not homelab-relevant",
 	})
 	require.NoError(t, err)
 	assert.Equal(t, "raw/rejected/2026-04-23-fed-sentiment-scrape.md", rel)
 	// Source removed from the pending queue.
 	_, statErr := os.Stat(filepath.Join(dir, "raw", "2026-04-23-fed-sentiment-scrape.md"))
 	assert.True(t, os.IsNotExist(statErr), "source removed from raw/ after reject")
 	got, err := os.ReadFile(filepath.Join(dir, filepath.FromSlash(rel)))
 	require.NoError(t, err)
 	s := string(got)
 	assert.Contains(t, s, "created_at: 2026-04-23T13:20:07Z", "original created_at preserved")
 	assert.Contains(t, s, "rejected_at:")
 	assert.Contains(t, s, "reject_reason: generic scrape, not homelab-relevant")
 	assert.Contains(t, s, "# Sentiment scrape", "body preserved for later reference")
 	// Rejected notes never entered the wiki, and are no longer pending.
 	pending, err := ListPending(dir)
 	require.NoError(t, err)
 	assert.Empty(t, pending)
 }
 func TestRejectWithoutReason(t *testing.T) {
 	dir := t.TempDir()
 	writeRaw(t, dir, "2026-06-01-x.md", "body\n")
 	rel, err := RejectNote(dir, RejectOptions{Filename: "2026-06-01-x.md"})
 	require.NoError(t, err)
 	got, _ := os.ReadFile(filepath.Join(dir, filepath.FromSlash(rel)))
 	assert.NotContains(t, string(got), "reject_reason:", "no reason given, none stamped")
 }
 func TestRejectMissingSourceErrors(t *testing.T) {
 	_, err := RejectNote(t.TempDir(), RejectOptions{Filename: "ghost.md"})
 	require.Error(t, err)
 }
 func TestRejectRejectsTraversalFilename(t *testing.T) {
 	_, err := RejectNote(t.TempDir(), RejectOptions{Filename: "../escape.md"})
 	require.Error(t, err)
 }
 func TestRejectCollisionNoOverwrite(t *testing.T) {
 	dir := t.TempDir()
 	dest := filepath.Join(dir, "raw", "rejected", "x.md")
 	require.NoError(t, os.MkdirAll(filepath.Dir(dest), 0o755))
 	require.NoError(t, os.WriteFile(dest, []byte("EXISTING\n"), 0o644))
 	writeRaw(t, dir, "x.md", "NEW\n")
 	_, err := RejectNote(dir, RejectOptions{Filename: "x.md"})
 	require.Error(t, err, "collision must error, not overwrite")
 	got, _ := os.ReadFile(dest)
 	assert.Equal(t, "EXISTING\n", string(got), "target not overwritten")
 	_, statErr := os.Stat(filepath.Join(dir, "raw", "x.md"))
 	assert.NoError(t, statErr, "source preserved on collision (atomic: no delete without write)")
 }
 func TestRejectedNotesAreNotListedAsPendingAgain(t *testing.T) {
 	// ListPending already skips tunnel-candidates-*.md; confirm raw/rejected/
 	// (a subdirectory) doesn't leak into the top-level pending listing either
 	// — os.ReadDir on raw/ doesn't recurse, but pin it so a future change to
 	// ListPending can't silently start surfacing rejected notes as pending
 	// again.
 	dir := t.TempDir()
 	writeRaw(t, dir, "2026-06-01-x.md", "body\n")
 	_, err := RejectNote(dir, RejectOptions{Filename: "2026-06-01-x.md"})
 	require.NoError(t, err)
 	pending, err := ListPending(dir)
 	require.NoError(t, err)
 	assert.Empty(t, pending, "a rejected note must not still appear as pending")
 }
@@ -1,21 +0,0 @@
 package api
 import (
 	"github.com/mathiasbq/hyperguild/ingestion/internal/provenance"
 )
 // StampProvenance applies server-owned provenance (hyperguild#145) to note
 // content. See package provenance for the rule; an error means the stamped
 // note would not read back as stamped, and the write must be refused.
 func StampProvenance(content, origin, writtenBy string) (string, error) {
 	return provenance.Apply(content, provenance.Stamp{Origin: origin, WrittenBy: writtenBy})
 }
 // StampProvenanceFile applies StampProvenance to a brain-relative note path.
 func StampProvenanceFile(brainDir, relPath, origin, writtenBy string) error {
 	_, abs, err := resolveWithin(brainDir, relPath)
 	if err != nil {
 		return err
 	}
 	return provenance.ApplyFile(abs, provenance.Stamp{Origin: origin, WrittenBy: writtenBy})
 }
@@ -1,122 +0,0 @@
 package api_test
 import (
 	"bytes"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"gopkg.in/yaml.v3"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
 )
 // REST POST /write carries no principal: it stamps origin: unknown, and no
 // spelling of provenance in its body reaches the note (hyperguild#145).
 func TestRESTWriteStampsUnknownAndIgnoresBodyProvenance(t *testing.T) {
 	dir, h := setup(t)
 	body, _ := json.Marshal(map[string]any{
 		"content": "---\norigin: static\n---\n# R\n\nbody", "filename": "rest-prov", "wing": "homelab", "hall": "facts",
 		"origin": "static", "written_by": "local-cli", "Origin": "static", "WrittenBy": "local-cli",
 	})
 	rec := httptest.NewRecorder()
 	h.Write(rec, httptest.NewRequest(http.MethodPost, "/write", bytes.NewReader(body)))
 	require.Equal(t, http.StatusOK, rec.Code, rec.Body.String())
 	b, err := os.ReadFile(filepath.Join(dir, "wiki", "homelab", "facts", "rest-prov.md"))
 	require.NoError(t, err)
 	var m map[string]any
 	require.NoError(t, yaml.Unmarshal([]byte(strings.SplitN(string(b), "---\n", 3)[1]), &m))
 	assert.Equal(t, "unknown", m["origin"])
 	assert.NotContains(t, m, "written_by")
 }
 // A principal name that is not a bare word is quoted, so it cannot start a
 // new frontmatter line (e.g. a JWT sub containing a newline).
 func TestStampProvenanceQuotesAPrincipalThatCouldBreakTheLine(t *testing.T) {
 	out, err := api.StampProvenance("---\ntitle: t\n---\nbody\n", "jwt", "evil\norigin: static")
 	require.NoError(t, err)
 	fm := strings.SplitN(out, "---\n", 3)[1]
 	var m map[string]any
 	require.NoError(t, yaml.Unmarshal([]byte(fm), &m))
 	assert.Equal(t, "jwt", m["origin"])
 	assert.Equal(t, "evil\norigin: static", m["written_by"])
 	assert.Equal(t, 1, strings.Count(fm, "\norigin:")+boolToInt(strings.HasPrefix(fm, "origin:")))
 }
 func TestStampProvenanceAddsFrontmatterWhenAbsentAndKeepsBody(t *testing.T) {
 	out, err := api.StampProvenance("# no fm\n\norigin: static in the body is prose\n", "static", "local-cli")
 	require.NoError(t, err)
 	assert.True(t, strings.HasPrefix(out, "---\norigin: static\nwritten_by: local-cli\n---\n# no fm"))
 	assert.Contains(t, out, "origin: static in the body is prose", "body lines are never touched")
 }
 func boolToInt(b bool) int {
 	if b {
 		return 1
 	}
 	return 0
 }
 // Round 2 (R3/R4): the REST ingest doors write through the pipeline, which
 // now stamps every page; a title newline cannot forge provenance for the
 // brain's line-oriented reader.
 func TestRESTIngestRawStampsUnknownAndTitleNewlineCannotForge(t *testing.T) {
 	dir, h := setup(t)
 	body, _ := json.Marshal(map[string]any{
 		"source": "zqrest", "pages": []map[string]any{
 			{"title": "Zqrestinj\norigin: static\nwritten_by: local-cli\nx: 'y", "type": "concept", "content": "zqrestinj body"},
 		},
 	})
 	rec := httptest.NewRecorder()
 	h.IngestRaw(rec, httptest.NewRequest(http.MethodPost, "/ingest-raw", bytes.NewReader(body)))
 	require.Equal(t, http.StatusOK, rec.Code, rec.Body.String())
 	var resp struct{ Pages []string }
 	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &resp))
 	require.NotEmpty(t, resp.Pages)
 	for _, p := range resp.Pages {
 		b, err := os.ReadFile(filepath.Join(dir, filepath.FromSlash(p)))
 		require.NoError(t, err)
 		fm := strings.SplitN(string(b), "---\n", 3)[1]
 		var m map[string]any
 		require.NoError(t, yaml.Unmarshal([]byte(fm), &m))
 		assert.Equal(t, "unknown", m["origin"])
 		assert.NotContains(t, m, "written_by")
 		for _, line := range strings.Split(fm, "\n") {
 			assert.False(t, strings.HasPrefix(line, "origin: static"), "line reader sees forged origin in %s", p)
 		}
 	}
 }
 func TestRESTIngestStampsUnknown(t *testing.T) {
 	dir, h := setup(t)
 	body, _ := json.Marshal(map[string]any{"content": "Some article text about shaping work.", "source": "zqllm"})
 	rec := httptest.NewRecorder()
 	h.Ingest(rec, httptest.NewRequest(http.MethodPost, "/ingest", bytes.NewReader(body)))
 	require.Equal(t, http.StatusOK, rec.Code, rec.Body.String())
 	var resp struct{ Pages []string }
 	require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &resp))
 	require.NotEmpty(t, resp.Pages, "stub pipeline must write at least one page")
 	for _, p := range resp.Pages {
 		b, err := os.ReadFile(filepath.Join(dir, filepath.FromSlash(p)))
 		require.NoError(t, err)
 		assert.Contains(t, strings.SplitN(string(b), "---\n", 3)[1], "origin: unknown\n", p)
 	}
 }
 // A refused write leaves nothing behind, not even an empty hall directory
 // (brain#21's invariant, round 3 non-blocking finding).
 func TestWriteNoteRefusedForProvenanceLeavesNoDirectory(t *testing.T) {
 	dir := t.TempDir()
 	_, err := api.WriteNote(dir, api.WriteNoteOptions{
 		Content: "# x\n\nbody", Wing: "freshwing", Hall: "facts", Filename: "x", Origin: "jwt", WrittenBy: "bad\xff",
 	})
 	require.Error(t, err)
 	_, statErr := os.Stat(filepath.Join(dir, "wiki", "freshwing"))
 	assert.True(t, os.IsNotExist(statErr), "no wing directory may be created by a refused write")
 }
@@ -1,172 +0,0 @@
 package api_test
 import (
 	"encoding/base64"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"strings"
 	"sync/atomic"
 	"syscall"
 	"testing"
 	"time"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
 )
 // hyperguild#153 / PR #156: behavioural race tests, so the control does not
 // rest on lints that list forbidden APIs (round 3: an os.ReadFile or
 // Root.ReadFile rewrite passed the lint and leaked 19k times in 4s). A
 // swapper keeps renaming a regular note, a symlink to an outside file, or a
 // FIFO into raw/r.md while the public readers loop. Any leaked byte fails;
 // any hang fails.
 const raceSentinel = "SENTINEL-153-RACE"
 func swap(raw, outside string, fifo bool, stop *atomic.Bool) {
 	tgt := filepath.Join(raw, "r.md")
 	for i := 0; !stop.Load(); i++ {
 		tmp := filepath.Join(raw, ".swap")
 		_ = os.Remove(tmp)
 		switch {
 		case i%2 == 0:
 			_ = os.WriteFile(tmp, []byte("# r\n\ninside"), 0o644)
 		case fifo:
 			_ = syscall.Mkfifo(tmp, 0o644)
 		default:
 			_ = os.Symlink(outside, tmp)
 		}
 		_ = os.Rename(tmp, tgt)
 	}
 }
 func raceBrain(t *testing.T) (brain, raw, outside string) {
 	t.Helper()
 	brain = t.TempDir()
 	raw = filepath.Join(brain, "raw")
 	if err := os.MkdirAll(raw, 0o755); err != nil {
 		t.Fatal(err)
 	}
 	outside = filepath.Join(t.TempDir(), "secret.md")
 	if err := os.WriteFile(outside, []byte("# s\n\n"+raceSentinel), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(raw, "r.md"), []byte("# r\n\ninside"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	return brain, raw, outside
 }
 // readers runs every public raw/ reader once and returns all text they
 // produced (excerpts, extracted text).
 func readers(brain, raw string) string {
 	var b strings.Builder
 	if ns, err := api.ListPending(brain); err == nil {
 		for _, n := range ns {
 			b.WriteString(n.Excerpt)
 		}
 	}
 	if s, err := api.ReadIngestFile(brain, filepath.Join(raw, "r.md")); err == nil {
 		b.WriteString(s)
 	}
 	return b.String()
 }
 func TestRawReadersLeakNothingUnderASymlinkSwapRace(t *testing.T) {
 	brain, raw, outside := raceBrain(t)
 	var stop atomic.Bool
 	go swap(raw, outside, false, &stop)
 	defer stop.Store(true)
 	leaks, iters := 0, 0
 	for deadline := time.Now().Add(1500 * time.Millisecond); time.Now().Before(deadline); iters++ {
 		leaks += strings.Count(readers(brain, raw), raceSentinel)
 	}
 	if leaks > 0 {
 		t.Fatalf("outside file leaked %d times in %d iterations", leaks, iters)
 	}
 	t.Logf("%d iterations, 0 leaks", iters)
 }
 func TestRawReadersDoNotHangUnderAFIFOSwapRace(t *testing.T) {
 	brain, raw, outside := raceBrain(t)
 	var stop atomic.Bool
 	go swap(raw, outside, true, &stop)
 	var iters atomic.Int64
 	done := make(chan struct{})
 	go func() {
 		for deadline := time.Now().Add(1500 * time.Millisecond); time.Now().Before(deadline); {
 			_ = readers(brain, raw)
 			iters.Add(1)
 		}
 		close(done)
 	}()
 	select {
 	case <-done:
 		stop.Store(true)
 	case <-time.After(6 * time.Second):
 		stop.Store(true)
 		// Unblock the stuck open so the test process can exit.
 		if f, err := os.OpenFile(filepath.Join(raw, "r.md"), os.O_WRONLY|syscall.O_NONBLOCK, 0); err == nil {
 			_ = f.Close()
 		}
 		t.Fatalf("a raw/ reader hung on a swapped-in FIFO after %d iterations", iters.Load())
 	}
 }
 // PR #156 round 4: the pdf/docmark branch of TextIn copies the file through
 // the root to a temp file; pointing the extractor back at the raw/ path by
 // name stayed green because the race tests only used r.md (a stub docmark
 // then received the outside file's bytes 34k times in 4s). This races a
 // symlink into raw/r.docx and has a fake docmark count the sentinel in every
 // document it is sent.
 func TestDocmarkExtractionLeaksNothingUnderASymlinkSwapRace(t *testing.T) {
 	var seen atomic.Int64
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		var req struct {
 			Params struct {
 				Arguments struct {
 					ContentBase64 string `json:"content_base64"`
 				} `json:"arguments"`
 			} `json:"params"`
 		}
 		_ = json.NewDecoder(r.Body).Decode(&req)
 		if b, err := base64.StdEncoding.DecodeString(req.Params.Arguments.ContentBase64); err == nil &&
 			strings.Contains(string(b), raceSentinel) {
 			seen.Add(1)
 		}
 		w.Header().Set("Content-Type", "application/json")
 		_, _ = w.Write([]byte(`{"jsonrpc":"2.0","id":1,"result":{"content":[{"type":"text","text":"converted"}]}}`))
 	}))
 	defer srv.Close()
 	t.Setenv("DOCMARK_URL", srv.URL)
 	brain, raw, outside := raceBrain(t)
 	tgt := filepath.Join(raw, "r.docx")
 	if err := os.WriteFile(tgt, []byte("inside docx bytes"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	var stop atomic.Bool
 	go func() {
 		for i := 0; !stop.Load(); i++ {
 			tmp := filepath.Join(raw, ".swapdocx")
 			_ = os.Remove(tmp)
 			if i%2 == 0 {
 				_ = os.WriteFile(tmp, []byte("inside docx bytes"), 0o644)
 			} else {
 				_ = os.Symlink(outside, tmp)
 			}
 			_ = os.Rename(tmp, tgt)
 		}
 	}()
 	defer stop.Store(true)
 	iters := 0
 	for deadline := time.Now().Add(1500 * time.Millisecond); time.Now().Before(deadline); iters++ {
 		_, _ = api.ReadIngestFile(brain, tgt)
 	}
 	if n := seen.Load(); n > 0 {
 		t.Fatalf("docmark received the outside file %d times in %d iterations", n, iters)
 	}
 	t.Logf("%d iterations, 0 leaks to docmark", iters)
 }
@@ -1,80 +0,0 @@
 package api_test
 import (
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
 )
 // hyperguild#153: readers of brain/raw/ followed symlinks. /pending showed the
 // target's contents and promote would copy it into wiki/ (and brain-sync to
 // Gitea). raw/ is writable via Syncthing, so a symlink there is reachable
 // input. Every raw/ reader now treats a symlink as not-a-note.
 const sentinel153 = "SENTINEL-153-OUTSIDE"
 func rawWithSymlink(t *testing.T) (brain string) {
 	t.Helper()
 	brain = t.TempDir()
 	raw := filepath.Join(brain, "raw")
 	require.NoError(t, os.MkdirAll(raw, 0o755))
 	outside := filepath.Join(t.TempDir(), "secret.md")
 	require.NoError(t, os.WriteFile(outside, []byte("---\ncreated_at: 2026-01-01T00:00:00Z\n---\n# s\n\n"+sentinel153), 0o644))
 	require.NoError(t, os.Symlink(outside, filepath.Join(raw, "2026-01-01-leak.md")))
 	require.NoError(t, os.WriteFile(filepath.Join(raw, "2026-01-02-real.md"), []byte("# real\n\nreal body"), 0o644))
 	return brain
 }
 func TestListPendingSkipsSymlinkedNotes(t *testing.T) {
 	notes, err := api.ListPending(rawWithSymlink(t))
 	require.NoError(t, err)
 	var names []string
 	for _, n := range notes {
 		names = append(names, n.Filename)
 		assert.NotContains(t, n.Excerpt, sentinel153)
 	}
 	assert.Equal(t, []string{"2026-01-02-real.md"}, names)
 }
 func TestPromoteNoteRefusesASymlinkedSource(t *testing.T) {
 	brain := rawWithSymlink(t)
 	_, err := api.PromoteNote(brain, api.PromoteOptions{Filename: "2026-01-01-leak.md", Wing: "testing", Hall: "facts"})
 	require.Error(t, err)
 	_, statErr := os.Stat(filepath.Join(brain, "wiki", "testing", "facts", "leak.md"))
 	assert.True(t, os.IsNotExist(statErr), "nothing may be promoted from a symlink")
 }
 func TestRejectNoteRefusesASymlinkedSource(t *testing.T) {
 	brain := rawWithSymlink(t)
 	_, err := api.RejectNote(brain, api.RejectOptions{Filename: "2026-01-01-leak.md"})
 	require.Error(t, err)
 	b, _ := os.ReadFile(filepath.Join(brain, "raw", "rejected", "2026-01-01-leak.md"))
 	assert.False(t, strings.Contains(string(b), sentinel153))
 }
 // Item 4: if raw/ itself is a symlink, containment inside it means nothing.
 func TestResolvePendingPromoteRejectAndReadIngestRefuseASymlinkedRawRoot(t *testing.T) {
 	brain := t.TempDir()
 	elsewhere := t.TempDir()
 	require.NoError(t, os.WriteFile(filepath.Join(elsewhere, "x.md"), []byte("# x\n\n"+sentinel153), 0o644))
 	require.NoError(t, os.Symlink(elsewhere, filepath.Join(brain, "raw")))
 	_, err := api.ResolveIngestPath(brain, "x.md")
 	assert.Error(t, err, "ingest must refuse a symlinked raw/")
 	notes, err := api.ListPending(brain)
 	assert.Error(t, err, "pending must refuse a symlinked raw/")
 	assert.Empty(t, notes)
 	_, err = api.PromoteNote(brain, api.PromoteOptions{Filename: "x.md", Wing: "testing", Hall: "facts"})
 	assert.Error(t, err, "promote must refuse a symlinked raw/")
 	_, err = api.RejectNote(brain, api.RejectOptions{Filename: "x.md"})
 	assert.Error(t, err, "reject must refuse a symlinked raw/")
 	text, err := api.ReadIngestFile(brain, filepath.Join(elsewhere, "x.md"))
 	assert.Error(t, err, "ReadIngestFile must refuse a symlinked raw/")
 	assert.NotContains(t, text, sentinel153)
 	// The watcher's refusal is tested in internal/watcher.
 }
@@ -1,67 +0,0 @@
 package api
 import (
 	"errors"
 	"fmt"
 	"io"
 	"os"
 	"path/filepath"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/extract"
 )
 // errNotANote is returned for a raw/ entry that is not a regular file — in
 // particular a symlink, whose target may be anywhere (hyperguild#153).
 var errNotANote = errors.New("not a regular note file in raw/ (symlinks are refused)")
 // errRawNotDir means brain/raw is not a real directory (e.g. a symlink), so
 // containment inside it would mean nothing (hyperguild#153 item 4).
 var errRawNotDir = errors.New("brain/raw is not a real directory")
 // OpenRawRoot opens brain/raw as an os.Root, refusing a raw/ that is itself a
 // symlink. Reads through the root cannot leave it, even if an entry is
 // swapped for a symlink between a check and the read. It returns the root
 // and raw/'s path. A missing raw/ returns an error wrapping os.ErrNotExist.
 func OpenRawRoot(brainDir string) (*os.Root, string, error) {
 	p := filepath.Join(brainDir, "raw")
 	fi, err := os.Lstat(p)
 	if err != nil {
 		return nil, "", err
 	}
 	if fi.Mode()&os.ModeSymlink != 0 || !fi.IsDir() {
 		return nil, "", errRawNotDir
 	}
 	r, err := os.OpenRoot(p)
 	if err != nil {
 		return nil, "", fmt.Errorf("open raw root: %w", err)
 	}
 	return r, p, nil
 }
 // readRawNote reads one raw/ entry by basename through the root, refusing
 // anything that is not a regular file.
 //
 // Accepted residual: a HARD link to an outside file is a regular file and is
 // read. Syncthing syncs contents, not links, so a peer cannot create one;
 // fs.protected_hardlinks=1 and the pod's secrets live on a different
 // filesystem from the brain volume, so a local caller cannot link them in.
 // Refusing Nlink > 1 is the next step if either assumption changes.
 func readRawNote(r *os.Root, base string) ([]byte, os.FileInfo, error) {
 	fi, err := r.Lstat(base)
 	if err != nil {
 		return nil, nil, err
 	}
 	if !fi.Mode().IsRegular() {
 		return nil, nil, errNotANote
 	}
 	f, _, err := extract.OpenRegular(r, base)
 	if err != nil {
 		return nil, nil, err
 	}
 	defer func() { _ = f.Close() }()
 	b, err := io.ReadAll(f)
 	if err != nil {
 		return nil, nil, err
 	}
 	return b, fi, nil
 }
@@ -10,7 +10,6 @@ import (
 	"time"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/brain"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/claim"
 )
 // ContentHash returns the lowercase hex sha256 of b. It is the note's
@@ -46,11 +45,6 @@ type UpdateNoteOptions struct {
 	Slug    string
 	Content string // new full body (whole-note replace)
 	Reason  string // optional; stamped as supersede_reason
 	// Origin/WrittenBy re-stamp provenance to the updating principal: the
 	// body is replaced wholesale, so the last writer is the author of what
 	// a reader sees (hyperguild#145). Never taken from Content's fragment.
 	Origin    string
 	WrittenBy string
 }
 // UpdateNote supersedes an existing note in place. It replaces the body
@@ -70,14 +64,6 @@ func UpdateNote(brainDir string, opts UpdateNoteOptions) (relPath, contentHash,
 		return "", "", "", fmt.Errorf("content is required")
 	}
 	// Same reason as WriteNote: the strip belongs in the primitive so every
 	// door inherits it.
 	clean, _, err := brain.StripUnresolvedLinks(brainDir, opts.Content)
 	if err != nil {
 		return "", "", "", err
 	}
 	opts.Content = clean
 	var rel string
 	if opts.Path != "" {
 		rel = opts.Path
@@ -104,65 +90,14 @@ func UpdateNote(brainDir string, opts UpdateNoteOptions) (relPath, contentHash,
 	}
 	priorHash = ContentHash(prior)
 	// A caller may lead opts.Content with its own frontmatter fence to set or
 	// change fields on supersede (e.g. the claim envelope). Split it off
 	// before it reaches the body — left un-split, it would render as a
 	// second, inert `---`-fenced block of literal text rather than taking
 	// effect, and any claim-envelope fields inside it would reach disk
 	// unvalidated (hyperguild#111: the same rule that guards note birth in
 	// writeHallNote must guard a change to the same fields).
 	contentFM, contentBody := parseFrontmatter(opts.Content)
 	fm, _ := parseFrontmatter(string(prior))
 	for _, l := range contentFM.lines {
 		// updated_at/supersedes/supersede_reason are this function's own
 		// output, not something a caller's fragment sets — updated_at and
 		// supersedes are already unconditionally re-set below regardless of
 		// what the loop does with them, but supersede_reason is only
 		// re-set when opts.Reason is non-empty, so without this skip a
 		// caller could set it via its own fragment and have it survive
 		// even when Reason is empty, bypassing the one intended entry
 		// point for that field (hyperguild#125, found in #111's review).
 		// Skipping all three here rather than relying on the unconditional
 		// overwrites below to save the other two keeps the invariant
 		// explicit at the one place it can be silently broken by a future
 		// reordering, not implicit in call order.
 		if l.key == "" || l.key == "updated_at" || l.key == "supersedes" || l.key == "supersede_reason" ||
 			l.key == "origin" || l.key == "written_by" {
 			continue
 		}
 		fm.set(l.key, l.value)
 	}
 	fm.set("updated_at", time.Now().UTC().Format(time.RFC3339))
 	fm.set("supersedes", priorHash)
 	if opts.Reason != "" {
 		fm.set("supersede_reason", opts.Reason)
 	}
-	// Validate the envelope AFTER the merge, against the full field set that
+	out := []byte(fm.render() + opts.Content)
 	// is about to reach disk — not just the caller's fragment. Validating the
 	// fragment alone would miss a caller that supersedes claim_provenance to
 	// empty while half_life/applies survive untouched from the prior note:
 	// each side looks individually fine, but the merged result is an
 	// unprovenanced envelope, which is the exact laundering this check
 	// exists to catch. (Caught in review before merge, not filed after —
 	// worth being honest about in the history: this second pass was the
 	// actual fix; the first one validated the wrong document.)
 	envelope := make(map[string]string, len(fm.lines))
 	for _, l := range fm.lines {
 		if l.key != "" {
 			envelope[l.key] = l.value
 		}
 	}
 	if err := claim.ValidateEnvelope(envelope); err != nil {
 		return "", "", "", fmt.Errorf("claim envelope: %w", err)
 	}
 	stamped, err := StampProvenance(fm.render()+contentBody, opts.Origin, opts.WrittenBy)
 	if err != nil {
 		return "", "", "", err
 	}
 	out := []byte(stamped)
 	if err := os.WriteFile(abs, out, 0o644); err != nil {
 		return "", "", "", fmt.Errorf("write: %w", err)
 	}
@@ -52,114 +52,6 @@ func TestUpdateNoteSupersedesAndStamps(t *testing.T) {
 	assert.Contains(t, s, "supersede_reason: facts changed")
 }
 func TestUpdateNoteRejectsInvalidEnvelopeAndWritesNothing(t *testing.T) {
 	// hyperguild#111: WriteNote validates the claim envelope before create;
 	// UpdateNote didn't before supersede, so the same rule must hold on
 	// change as on birth, fail-closed, nothing written on rejection.
 	brainDir := t.TempDir()
 	original := "---\nwing: jepa-fx\nhall: facts\ncreated_at: 2026-01-01T00:00:00Z\n---\n# Old\n\nold body\n"
 	rel := seedNote(t, brainDir, "wiki/jepa-fx/facts/val-vol.md", original)
 	_, _, _, err := UpdateNote(brainDir, UpdateNoteOptions{
 		Path:    rel,
 		Content: "---\nhalf_life: forever\n---\n# New\n\nnew body\n",
 	})
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "claim envelope")
 	got, err := os.ReadFile(filepath.Join(brainDir, filepath.FromSlash(rel)))
 	require.NoError(t, err)
 	assert.Equal(t, original, string(got), "rejected update must leave the note byte-identical")
 }
 func TestUpdateNoteRejectsAppliesWithoutProvenance(t *testing.T) {
 	brainDir := t.TempDir()
 	original := "---\nwing: jepa-fx\nhall: facts\n---\nold\n"
 	rel := seedNote(t, brainDir, "wiki/jepa-fx/facts/val-vol.md", original)
 	_, _, _, err := UpdateNote(brainDir, UpdateNoteOptions{
 		Path:    rel,
 		Content: "---\napplies: universal\n---\nnew\n",
 	})
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "claim envelope")
 	got, err := os.ReadFile(filepath.Join(brainDir, filepath.FromSlash(rel)))
 	require.NoError(t, err)
 	assert.Equal(t, original, string(got))
 }
 func TestUpdateNoteAcceptsValidEnvelopeAndMergesIntoFrontmatter(t *testing.T) {
 	brainDir := t.TempDir()
 	rel := seedNote(t, brainDir, "wiki/jepa-fx/facts/val-vol.md",
 		"---\nwing: jepa-fx\nhall: facts\ncreated_at: 2026-01-01T00:00:00Z\n---\nold\n")
 	_, _, _, err := UpdateNote(brainDir, UpdateNoteOptions{
 		Path:    rel,
 		Content: "---\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\nnew body\n",
 	})
 	require.NoError(t, err)
 	got, err := os.ReadFile(filepath.Join(brainDir, filepath.FromSlash(rel)))
 	require.NoError(t, err)
 	s := string(got)
 	assert.Contains(t, s, "half_life: durable")
 	assert.Contains(t, s, "applies: universal")
 	assert.Contains(t, s, "claim_provenance: asserted")
 	assert.Contains(t, s, "wing: jepa-fx", "prior fields survive")
 	assert.Contains(t, s, "new body")
 	assert.Equal(t, 2, strings.Count(s, "---\n"),
 		"exactly one open+close fence pair — the caller's own fence must not leak in as a second, inert block")
 }
 func TestUpdateNoteRejectsClearingProvenanceWhileEnvelopeSurvives(t *testing.T) {
 	// Found in review, not written speculatively: validating only the
 	// caller's fragment (rather than the merged result) let a caller blank
 	// out claim_provenance alone while half_life/applies survived from the
 	// prior note untouched — each side looks fine on its own, the merged
 	// envelope on disk is the unprovenanced one the whole check exists to
 	// catch.
 	brainDir := t.TempDir()
 	original := "---\nwing: jepa-fx\nhall: facts\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\nold\n"
 	rel := seedNote(t, brainDir, "wiki/jepa-fx/facts/val-vol.md", original)
 	_, _, _, err := UpdateNote(brainDir, UpdateNoteOptions{
 		Path:    rel,
 		Content: "---\nclaim_provenance: \n---\nnew body\n",
 	})
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "claim envelope")
 	got, err := os.ReadFile(filepath.Join(brainDir, filepath.FromSlash(rel)))
 	require.NoError(t, err)
 	assert.Equal(t, original, string(got), "rejected update must leave the note byte-identical")
 }
 func TestUpdateNoteWithoutEnvelopeFieldsIsUnchangedFromToday(t *testing.T) {
 	// Regression pin: plain fence-less content (the common case) must behave
 	// exactly as it did before the envelope-merge fix.
 	brainDir := t.TempDir()
 	rel := seedNote(t, brainDir, "wiki/jepa-fx/facts/val-vol.md",
 		"---\nwing: jepa-fx\nhall: facts\ncreated_at: 2026-01-01T00:00:00Z\ncustom: keep-me\n---\n# Old\n\nold body\n")
 	relPath, hash, priorHash, err := UpdateNote(brainDir, UpdateNoteOptions{
 		Path:    rel,
 		Content: "# New\n\nnew body\n",
 		Reason:  "facts changed",
 	})
 	require.NoError(t, err)
 	assert.Equal(t, rel, relPath)
 	assert.NotEmpty(t, hash)
 	assert.NotEqual(t, hash, priorHash)
 	got, err := os.ReadFile(filepath.Join(brainDir, filepath.FromSlash(rel)))
 	require.NoError(t, err)
 	s := string(got)
 	assert.Contains(t, s, "# New")
 	assert.Contains(t, s, "custom: keep-me")
 	assert.Contains(t, s, "supersedes: "+priorHash)
 }
 func TestUpdateNoteResolvesByWingHallSlug(t *testing.T) {
 	brainDir := t.TempDir()
 	seedNote(t, brainDir, "wiki/jepa-fx/facts/val-vol.md",
@@ -231,45 +123,6 @@ func TestUpdateThenReadRoundTripsHash(t *testing.T) {
 	assert.Equal(t, hash, readHash, "update content_hash must round-trip through ReadNote")
 }
 func TestUpdateNoteSupersedeReasonNotSettableViaCallerFragmentWhenReasonOptionEmpty(t *testing.T) {
 	// hyperguild#125, found in #111's review: the merge loop applied every
 	// field from the caller's leading frontmatter fragment, including
 	// supersede_reason -- which is only re-set unconditionally when
 	// opts.Reason is non-empty, so a caller could set it via its own
 	// fragment and have it survive even with Reason left empty, bypassing
 	// the one intended entry point for that field.
 	brainDir := t.TempDir()
 	rel := seedNote(t, brainDir, "wiki/a/facts/n.md", "---\nwing: a\nhall: facts\n---\nold\n")
 	_, _, _, err := UpdateNote(brainDir, UpdateNoteOptions{
 		Path:    rel,
 		Content: "---\nsupersede_reason: snuck in via the fragment\n---\nnew\n",
 		// Reason deliberately left empty.
 	})
 	require.NoError(t, err)
 	got, err := os.ReadFile(filepath.Join(brainDir, filepath.FromSlash(rel)))
 	require.NoError(t, err)
 	assert.NotContains(t, string(got), "supersede_reason",
 		"supersede_reason must not appear at all when opts.Reason is empty, regardless of what the fragment tried to set")
 }
 func TestUpdateNoteSupersedeReasonFromOptionStillWorks(t *testing.T) {
 	// Regression pin: the legitimate entry point (opts.Reason) must be
 	// completely unaffected by #125's fix.
 	brainDir := t.TempDir()
 	rel := seedNote(t, brainDir, "wiki/a/facts/n.md", "---\nwing: a\nhall: facts\n---\nold\n")
 	_, _, _, err := UpdateNote(brainDir, UpdateNoteOptions{
 		Path: rel, Content: "new\n", Reason: "facts changed",
 	})
 	require.NoError(t, err)
 	got, err := os.ReadFile(filepath.Join(brainDir, filepath.FromSlash(rel)))
 	require.NoError(t, err)
 	assert.Contains(t, string(got), "supersede_reason: facts changed")
 }
 func TestContentHashStable(t *testing.T) {
 	assert.Equal(t, ContentHash([]byte("abc")), ContentHash([]byte("abc")))
 	assert.NotEqual(t, ContentHash([]byte("abc")), ContentHash([]byte("abd")))
@@ -1,157 +0,0 @@
 package brain
 import (
 	"fmt"
 	"os"
 	"path/filepath"
 	"regexp"
 	"sort"
 	"strings"
 )
 // wikilinkRE matches [[target]] and [[target|Display Text]].
 var wikilinkRE = regexp.MustCompile(`\[\[([^\]|]+)(?:\|([^\]]*))?\]\]`)
 // fencedCodeRE and inlineCodeRE mark the regions where a [[...]] is a
 // syntax example rather than a link. Same exclusion brain-gardener's audit
 // applies on the read side, so the write gate and the audit agree on what
 // counts as a link at all.
 var (
 	fencedCodeRE = regexp.MustCompile("(?s)```.*?```")
 	inlineCodeRE = regexp.MustCompile("`[^`\n]*`")
 )
 // StripUnresolvedLinks unwraps every [[wikilink]] in content whose target
 // resolves to no entry under knowledge/ or wiki/, leaving the link's display
 // text (or its target) as plain prose. It returns the rewritten content and
 // the sorted, de-duplicated targets it unwrapped.
 //
 // WHY UNWRAP RATHER THAN REJECT THE WRITE
 // Agents write [[...]] around anything that feels related — a skill name, a
 // repo, an agent-local memory file — and none of those are brain entries.
 // Every one of those becomes a permanent [high] broken-link finding that no
 // deterministic Fixer can repair, because there is no target to repoint to:
 // the brain-audit digest grew from 19 to 63 high findings between 2026-08-26
 // and 2026-09-16, and 53 of the 63 were exactly this. Rejecting the write
 // instead would push the failure onto claudewatcher's unattended ingest path,
 // where a refused write is a lost learning. Unwrapping keeps the author's
 // words, keeps the write, and keeps the graph honest.
 //
 // An empty corpus (no knowledge/ or wiki/ yet, or a misconfigured brainDir)
 // returns content unchanged: nothing resolving is a bootstrap state, not
 // evidence that every target was invented.
 func StripUnresolvedLinks(brainDir, content string) (string, []string, error) {
 	index, err := entryIndex(brainDir)
 	if err != nil {
 		return "", nil, err
 	}
 	if len(index) == 0 {
 		return content, nil, nil
 	}
 	code := codeSpans(content)
 	stripped := map[string]struct{}{}
 	var b strings.Builder
 	last := 0
 	for _, m := range wikilinkRE.FindAllStringSubmatchIndex(content, -1) {
 		start, end := m[0], m[1]
 		if overlaps(start, end, code) {
 			continue
 		}
 		target := strings.TrimSpace(content[m[2]:m[3]])
 		if _, ok := index[linkKey(target)]; ok {
 			continue
 		}
 		display := target
 		if m[4] >= 0 {
 			if d := strings.TrimSpace(content[m[4]:m[5]]); d != "" {
 				display = d
 			}
 		}
 		b.WriteString(content[last:start])
 		b.WriteString(display)
 		last = end
 		stripped[target] = struct{}{}
 	}
 	if last == 0 {
 		return content, nil, nil
 	}
 	b.WriteString(content[last:])
 	targets := make([]string, 0, len(stripped))
 	for t := range stripped {
 		targets = append(targets, t)
 	}
 	sort.Strings(targets)
 	return b.String(), targets, nil
 }
 // linkedTrees are the two trees that hold linkable entries — the same pair
 // package notes admits under ScopeNotes. Duplicated rather than imported
 // because that list is unexported there and this is a read-only mirror.
 var linkedTrees = []string{"knowledge", "wiki"}
 // entryIndex maps every form a wikilink may name an entry by — its bare slug
 // and its path form (wiki/<wing>/<hall>/<slug>.md -> wing/hall/slug) — to a
 // present marker. Mirrors brain-gardener's resolver so an accepted link is
 // one the audit will also resolve.
 func entryIndex(brainDir string) (map[string]struct{}, error) {
 	index := map[string]struct{}{}
 	for _, dir := range linkedTrees {
 		root := filepath.Join(brainDir, dir)
 		if _, err := os.Stat(root); os.IsNotExist(err) {
 			continue
 		} else if err != nil {
 			return nil, fmt.Errorf("stat %s: %w", dir, err)
 		}
 		err := filepath.WalkDir(root, func(path string, d os.DirEntry, err error) error {
 			if err != nil {
 				return err
 			}
 			if d.IsDir() || !strings.HasSuffix(path, ".md") {
 				return nil
 			}
 			rel, err := filepath.Rel(brainDir, path)
 			if err != nil {
 				return err
 			}
 			rel = filepath.ToSlash(rel)
 			index[strings.TrimSuffix(filepath.Base(rel), ".md")] = struct{}{}
 			index[strings.TrimPrefix(strings.TrimSuffix(rel, ".md"), "wiki/")] = struct{}{}
 			return nil
 		})
 		if err != nil {
 			return nil, fmt.Errorf("walk %s: %w", dir, err)
 		}
 	}
 	return index, nil
 }
 // linkKey normalises a link target for index lookup: an exact path form is
 // tried as written, and anything else falls back to its final segment.
 func linkKey(target string) string {
 	return strings.TrimSuffix(target, ".md")
 }
 // codeSpans returns the byte ranges of fenced blocks and inline code spans.
 func codeSpans(content string) [][2]int {
 	var spans [][2]int
 	for _, m := range fencedCodeRE.FindAllStringIndex(content, -1) {
 		spans = append(spans, [2]int{m[0], m[1]})
 	}
 	for _, m := range inlineCodeRE.FindAllStringIndex(content, -1) {
 		spans = append(spans, [2]int{m[0], m[1]})
 	}
 	return spans
 }
 // overlaps reports whether [start,end) intersects any span.
 func overlaps(start, end int, spans [][2]int) bool {
 	for _, s := range spans {
 		if start < s[1] && end > s[0] {
 			return true
 		}
 	}
 	return false
 }
@@ -1,93 +0,0 @@
 package brain_test
 import (
 	"testing"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/brain"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 // seedCorpus writes the two entries every linkcheck case resolves against.
 func seedCorpus(t *testing.T, dir string) {
 	t.Helper()
 	seedNote(t, dir, "wiki/homelab/facts/real-entry.md",
 		"---\nwing: homelab\nhall: facts\ntitle: 'Real entry'\n---\n\nbody.\n")
 	seedNote(t, dir, "knowledge/legacy-entry.md",
 		"---\ntitle: 'Legacy entry'\n---\n\nbody.\n")
 }
 func TestStripUnresolvedLinks(t *testing.T) {
 	tests := []struct {
 		name     string
 		body     string
 		want     string
 		stripped []string
 	}{
 		{
 			name: "bare slug that resolves is kept",
 			body: "See [[real-entry]] for the rule.",
 			want: "See [[real-entry]] for the rule.",
 		},
 		{
 			name: "path-style target that resolves is kept",
 			body: "See [[homelab/facts/real-entry]].",
 			want: "See [[homelab/facts/real-entry]].",
 		},
 		{
 			name: "knowledge/ entry resolves by bare slug",
 			body: "See [[legacy-entry]].",
 			want: "See [[legacy-entry]].",
 		},
 		{
 			name:     "unresolvable target is unwrapped to plain text",
 			body:     "Related: [[secret-hygiene]].",
 			want:     "Related: secret-hygiene.",
 			stripped: []string{"secret-hygiene"},
 		},
 		{
 			name:     "unresolvable aliased target keeps its display text",
 			body:     "Related: [[feedback_check_host_not_assume|check the host]].",
 			want:     "Related: check the host.",
 			stripped: []string{"feedback_check_host_not_assume"},
 		},
 		{
 			name: "link inside a fenced code block is left alone",
 			body: "Syntax:\n\n```\n[[wing/hall/slug]]\n```\n",
 			want: "Syntax:\n\n```\n[[wing/hall/slug]]\n```\n",
 		},
 		{
 			name: "link inside an inline code span is left alone",
 			body: "Write `[[wing/hall/slug]]` to link.",
 			want: "Write `[[wing/hall/slug]]` to link.",
 		},
 		{
 			name:     "every unresolvable target is reported once, sorted",
 			body:     "[[zeta-gap]] and [[alpha-gap]] and [[zeta-gap]] again.",
 			want:     "zeta-gap and alpha-gap and zeta-gap again.",
 			stripped: []string{"alpha-gap", "zeta-gap"},
 		},
 	}
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
 			dir := t.TempDir()
 			seedCorpus(t, dir)
 			got, stripped, err := brain.StripUnresolvedLinks(dir, tc.body)
 			require.NoError(t, err)
 			assert.Equal(t, tc.want, got)
 			assert.Equal(t, tc.stripped, stripped)
 		})
 	}
 }
 func TestStripUnresolvedLinks_MissingBrainDirIsNotAGate(t *testing.T) {
 	// A brain dir with no knowledge//wiki/ tree yet must not turn every link
 	// into an unresolved one — an empty corpus is a bootstrap state, not
 	// evidence that the author invented the target.
 	got, stripped, err := brain.StripUnresolvedLinks(t.TempDir(), "See [[real-entry]].")
 	require.NoError(t, err)
 	assert.Equal(t, "See [[real-entry]].", got)
 	assert.Nil(t, stripped)
 }
@@ -54,24 +54,11 @@ func DetectTunnels(brainDir, content string) ([]TunnelCandidate, error) {
 			return nil
 		}
 		title, _ := readTitleAndCreated(path, strings.TrimSuffix(d.Name(), ".md"))
-		title = strings.TrimSpace(title)
+		needle := strings.ToLower(strings.TrimSpace(title))
-		if title == "" {
+		if needle == "" {
 			return nil
 		}
-
+		idx := strings.Index(lowerContent, needle)
 		// A one-word title has to match the prose case-exactly. Matched
 		// case-insensitively, it links every entry that happens to use the
 		// word: "WRONG" (wiki/telos/decisions/wrong.md) collected 185 inbound
 		// See-also links and "Status" 136, making the two most-linked nodes in
 		// the graph artifacts of the English language rather than references.
 		// Multi-word titles keep the case-insensitive match — "risk tier
 		// middleware" in prose is a real mention however it is capitalised,
 		// and a three-word collision is not an accident.
 		haystack, needle := lowerContent, strings.ToLower(title)
 		if isSingleWord(title) {
 			haystack, needle = content, title
 		}
 		idx := strings.Index(haystack, needle)
 		if idx == -1 {
 			return nil
 		}
@@ -82,7 +69,7 @@ func DetectTunnels(brainDir, content string) ([]TunnelCandidate, error) {
 		out = append(out, TunnelCandidate{
 			TargetPath:  filepath.ToSlash(rel),
 			MatchedTerm: title,
-			Exact:       isWholeWord(haystack, idx, len(needle)),
+			Exact:       isWholeWord(lowerContent, idx, len(needle)),
 		})
 		return nil
 	})
@@ -92,11 +79,6 @@ func DetectTunnels(brainDir, content string) ([]TunnelCandidate, error) {
 	return out, nil
 }
 // isSingleWord reports whether title is one whitespace-free token.
 func isSingleWord(title string) bool {
 	return !strings.ContainsAny(title, " \t")
 }
 // isWholeWord reports whether the substring at [idx, idx+n) in s is
 // bounded by non-alphanumeric characters (or string edges).
 func isWholeWord(s string, idx, n int) bool {
@@ -101,28 +101,15 @@ func TestDetectTunnels_ExactTitleMatch(t *testing.T) {
 }
 func TestDetectTunnels_FuzzyMatch(t *testing.T) {
 	dir := t.TempDir()
 	seedNote(t, dir, "wiki/x/facts/routing-table.md",
 		"---\ntitle: 'Routing Table'\n---\nbody.\n")
 	// Substring of title appears in content, but not as a whole word.
 	candidates, err := brain.DetectTunnels(dir, "the routing tables were rebuilt")
 	require.NoError(t, err)
 	require.Len(t, candidates, 1)
 	assert.False(t, candidates[0].Exact, "substring-only match should be fuzzy")
 }
 // A one-word title whose only appearance is lowercase inside another word is
 // not even a candidate: it would fill the review file with English rather than
 // with references.
 func TestDetectTunnels_SingleWordSubstringIsNotACandidate(t *testing.T) {
 	dir := t.TempDir()
 	seedNote(t, dir, "wiki/x/facts/routing.md",
 		"---\ntitle: Routing\n---\nbody.\n")
 	// Substring of title appears in content, but not as a whole word.
 	candidates, err := brain.DetectTunnels(dir, "rerouting handles failover")
 	require.NoError(t, err)
-	assert.Empty(t, candidates)
+	require.Len(t, candidates, 1)
 	assert.False(t, candidates[0].Exact, "substring-only match should be fuzzy")
 }
 func TestDetectTunnels_NoFrontmatterFallsBackToSlug(t *testing.T) {
@@ -139,21 +126,20 @@ func TestDetectTunnels_NoFrontmatterFallsBackToSlug(t *testing.T) {
 func TestAutoTunnel_FuzzyGoesToCandidatesFile(t *testing.T) {
 	dir := t.TempDir()
-	// Existing note in a different wing whose title is "Routing Table".
+	// Existing note in a different wing whose title is "Routing".
-	seedNote(t, dir, "wiki/other/facts/routing-table.md",
+	seedNote(t, dir, "wiki/other/facts/routing.md",
-		"---\nwing: other\nhall: facts\ntitle: 'Routing Table'\n---\nbody.\n")
+		"---\nwing: other\nhall: facts\ntitle: Routing\n---\nbody.\n")
-	// Source note in another wing whose body mentions "routing tables"
+	// Source note in another wing whose body mentions "rerouting" (substring match only).
 	// (substring match only — the title is not there as a whole word).
 	seedNote(t, dir, "wiki/jepa-fx/facts/new.md",
-		"---\nwing: jepa-fx\nhall: facts\n---\nrouting tables rebuilt\n")
+		"---\nwing: jepa-fx\nhall: facts\n---\nrerouting traffic\n")
 	require.NoError(t, brain.AutoTunnel(dir,
-		"wiki/jepa-fx/facts/new.md", "routing tables rebuilt"))
+		"wiki/jepa-fx/facts/new.md", "rerouting traffic"))
 	// Source must not get auto-linked (fuzzy).
 	got, err := os.ReadFile(filepath.Join(dir, "wiki/jepa-fx/facts/new.md"))
 	require.NoError(t, err)
-	assert.NotContains(t, string(got), "[[other/facts/routing-table]]")
+	assert.NotContains(t, string(got), "[[other/facts/routing]]")
 	// Candidates file must list the pair.
 	matches, err := filepath.Glob(filepath.Join(dir, "raw", "tunnel-candidates-*.md"))
@@ -162,7 +148,7 @@ func TestAutoTunnel_FuzzyGoesToCandidatesFile(t *testing.T) {
 	body, err := os.ReadFile(matches[0])
 	require.NoError(t, err)
 	assert.Contains(t, string(body), "wiki/jepa-fx/facts/new.md")
-	assert.Contains(t, string(body), "wiki/other/facts/routing-table.md")
+	assert.Contains(t, string(body), "wiki/other/facts/routing.md")
 	assert.Contains(t, string(body), "Routing")
 }
@@ -189,35 +175,3 @@ func TestWriteTunnel_AppendsToExistingSeeAlso(t *testing.T) {
 	assert.Contains(t, s, "[[a/facts/old]]")
 	assert.Contains(t, s, "[[b/facts/y]]")
 }
 // A one-word title matched case-insensitively links every entry that happens
 // to use that word. Live cost before this rule: 185 entries auto-linked to
 // wiki/telos/decisions/wrong.md (title "WRONG") and 136 to .../status.md,
 // making the two most-linked nodes in the graph pure artifacts.
 func TestDetectTunnels_SingleWordTitleNeedsAnExactCaseMatch(t *testing.T) {
 	dir := t.TempDir()
 	seedNote(t, dir, "wiki/telos/decisions/wrong.md",
 		"---\nwing: telos\nhall: decisions\ntitle: WRONG\n---\n# WRONG\n\nRetired beliefs.\n")
 	got, err := brain.DetectTunnels(dir, "The obvious fix was to reject the write. Wrong here.")
 	require.NoError(t, err)
 	for _, c := range got {
 		assert.False(t, c.Exact, "a lowercase prose word must not auto-link a one-word title: %+v", c)
 	}
 	got, err = brain.DetectTunnels(dir, "The beliefs listed under WRONG were retired.")
 	require.NoError(t, err)
 	require.Len(t, got, 1)
 	assert.True(t, got[0].Exact, "the title's own casing appearing in prose is a real reference")
 }
 func TestDetectTunnels_MultiWordTitleStaysCaseInsensitive(t *testing.T) {
 	dir := t.TempDir()
 	seedNote(t, dir, "wiki/homelab/facts/risk-tier.md",
 		"---\nwing: homelab\nhall: facts\ntitle: 'Risk Tier Middleware'\n---\nbody\n")
 	got, err := brain.DetectTunnels(dir, "We rebuilt the risk tier middleware last week.")
 	require.NoError(t, err)
 	require.Len(t, got, 1)
 	assert.True(t, got[0].Exact)
 }
@@ -1,113 +0,0 @@
 // Package brainfs reads the brain directory through an os.Root (hyperguild#157).
 // The brain dir is a Syncthing sendreceive folder and Syncthing syncs
 // symlinks; a reader that walks and reads by path follows a planted symlink
 // out of the brain, and blocks forever on a planted FIFO. Readers that go
 // through a Brain only ever read regular files inside the brain: os.Root
 // refuses to leave the root even if an entry is swapped mid-read, and every
 // open is non-blocking with the type checked on the opened handle.
 package brainfs
 import (
 	"errors"
 	"fmt"
 	"io"
 	"io/fs"
 	"os"
 	"path/filepath"
 	"syscall"
 )
 // ErrNotRegular is returned for an entry that is not a regular file.
 var ErrNotRegular = errors.New("not a regular file")
 // Brain is an open brain directory.
 type Brain struct {
 	root *os.Root
 	dir  string
 }
 // Open opens brainDir (which may itself be a mount symlink) as a root.
 func Open(brainDir string) (*Brain, error) {
 	r, err := os.OpenRoot(brainDir)
 	if err != nil {
 		return nil, fmt.Errorf("open brain root: %w", err)
 	}
 	return &Brain{root: r, dir: brainDir}, nil
 }
 // Close releases the root.
 func (b *Brain) Close() error { return b.root.Close() }
 // Rel converts a path under the brain dir to a root-relative path.
 func (b *Brain) Rel(path string) (string, error) {
 	rel, err := filepath.Rel(b.dir, path)
 	if err != nil {
 		return "", err
 	}
 	if rel == ".." || len(rel) > 2 && rel[:3] == ".."+string(filepath.Separator) {
 		return "", fmt.Errorf("%s is outside the brain dir", path)
 	}
 	return filepath.ToSlash(rel), nil
 }
 // ReadRegular reads a brain-relative path, refusing anything that is not a
 // regular file, both before the open and on the opened handle.
 func (b *Brain) ReadRegular(rel string) ([]byte, error) {
 	fi, err := b.root.Lstat(rel)
 	if err != nil {
 		return nil, err
 	}
 	if !fi.Mode().IsRegular() {
 		return nil, fmt.Errorf("%s: %w", rel, ErrNotRegular)
 	}
 	return b.readOpened(rel)
 }
 // readOpened opens rel non-blocking and reads it only if the OPENED handle is
 // a regular file. This is the check that matters under a race: an entry
 // swapped for a FIFO after the Lstat, with a writer holding it open, would
 // otherwise park io.ReadAll forever (PR #161 review: removing it hung search
 // after 16 iterations).
 //
 // Accepted residual, as in api/rawroot.go: a HARD link to an outside file is
 // a regular file and is read. Syncthing syncs contents, not links, so a peer
 // cannot create one; fs.protected_hardlinks=1 and the pod's secrets are on a
 // different filesystem from the brain volume, so a local caller cannot link
 // them in. Refusing Nlink > 1 is the next step if either changes.
 func (b *Brain) readOpened(rel string) ([]byte, error) {
 	f, err := b.root.OpenFile(rel, os.O_RDONLY|syscall.O_NONBLOCK, 0)
 	if err != nil {
 		return nil, err
 	}
 	defer func() { _ = f.Close() }()
 	hfi, err := f.Stat()
 	if err != nil {
 		return nil, err
 	}
 	if !hfi.Mode().IsRegular() {
 		return nil, fmt.Errorf("%s: %w", rel, ErrNotRegular)
 	}
 	return io.ReadAll(f)
 }
 // WalkRegular walks a brain-relative directory through the root and calls fn
 // for each regular file (directories are descended; symlinks, FIFOs and
 // devices are skipped, never followed). An entry error is passed to onErr and
 // the walk continues; a nil onErr ignores it.
 func (b *Brain) WalkRegular(relDir string, fn func(rel string) error, onErr func(rel string, err error)) error {
 	return fs.WalkDir(b.root.FS(), filepath.ToSlash(relDir), func(p string, d fs.DirEntry, err error) error {
 		if err != nil {
 			if onErr != nil {
 				onErr(p, err)
 			}
 			if d != nil && d.IsDir() {
 				return fs.SkipDir
 			}
 			return nil
 		}
 		if d.IsDir() || !d.Type().IsRegular() {
 			return nil
 		}
 		return fn(p)
 	})
 }
@@ -1,92 +0,0 @@
 package brainfs
 import (
 	"errors"
 	"os"
 	"path/filepath"
 	"syscall"
 	"testing"
 	"time"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 // The handle check is what stops a FIFO swapped in after the Lstat. A FIFO
 // with no writer reads EOF at once, so a race test could not see the check
 // missing; here a writer holds the FIFO open, as any local process can, and
 // readOpened must refuse it promptly (PR #161 review).
 func TestReadOpenedRefusesAFIFOHeldOpenByAWriter(t *testing.T) {
 	dir := t.TempDir()
 	fifo := filepath.Join(dir, "p.md")
 	require.NoError(t, syscall.Mkfifo(fifo, 0o644))
 	w, err := os.OpenFile(fifo, os.O_RDWR, 0)
 	require.NoError(t, err)
 	defer func() { _ = w.Close() }()
 	b, err := Open(dir)
 	require.NoError(t, err)
 	defer func() { _ = b.Close() }()
 	done := make(chan error, 1)
 	go func() { _, err := b.readOpened("p.md"); done <- err }()
 	select {
 	case err := <-done:
 		assert.True(t, errors.Is(err, ErrNotRegular), "got %v", err)
 	case <-time.After(2 * time.Second):
 		t.Fatal("readOpened blocked on a FIFO with a writer")
 	}
 }
 func TestReadRegularRefusesSymlinksAndReadsRegularFiles(t *testing.T) {
 	dir := t.TempDir()
 	require.NoError(t, os.WriteFile(filepath.Join(dir, "ok.md"), []byte("ok"), 0o644))
 	outside := filepath.Join(t.TempDir(), "s.md")
 	require.NoError(t, os.WriteFile(outside, []byte("secret"), 0o644))
 	require.NoError(t, os.Symlink(outside, filepath.Join(dir, "link.md")))
 	b, err := Open(dir)
 	require.NoError(t, err)
 	defer func() { _ = b.Close() }()
 	got, err := b.ReadRegular("ok.md")
 	require.NoError(t, err)
 	assert.Equal(t, "ok", string(got))
 	_, err = b.ReadRegular("link.md")
 	assert.True(t, errors.Is(err, ErrNotRegular), "got %v", err)
 	_, err = b.ReadRegular("../" + filepath.Base(outside))
 	assert.Error(t, err)
 }
 func TestRelAcceptsPathsInsideAndRefusesEscapes(t *testing.T) {
 	dir := t.TempDir()
 	b, err := Open(dir)
 	require.NoError(t, err)
 	defer func() { _ = b.Close() }()
 	for in, want := range map[string]string{
 		filepath.Join(dir, "wiki", "x.md"): "wiki/x.md",
 		filepath.Join(dir, "..foo", "x"):   "..foo/x",
 		dir:                                ".",
 	} {
 		got, err := b.Rel(in)
 		require.NoError(t, err, in)
 		assert.Equal(t, want, got, in)
 	}
 	for _, bad := range []string{filepath.Join(dir, "..", "x"), dir + "-evil/x", "/etc/passwd", filepath.Join(dir, "wiki", "..", "..", "x")} {
 		_, err := b.Rel(bad)
 		assert.Error(t, err, bad)
 	}
 }
 func TestWalkRegularYieldsOnlyRegularFiles(t *testing.T) {
 	dir := t.TempDir()
 	require.NoError(t, os.MkdirAll(filepath.Join(dir, "a"), 0o755))
 	require.NoError(t, os.WriteFile(filepath.Join(dir, "a", "n.md"), []byte("n"), 0o644))
 	require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(dir, "a", "dirlink")))
 	require.NoError(t, os.Symlink(filepath.Join(dir, "a", "n.md"), filepath.Join(dir, "a", "filelink.md")))
 	require.NoError(t, syscall.Mkfifo(filepath.Join(dir, "a", "p.md"), 0o644))
 	b, err := Open(dir)
 	require.NoError(t, err)
 	defer func() { _ = b.Close() }()
 	var got []string
 	require.NoError(t, b.WalkRegular(".", func(rel string) error { got = append(got, rel); return nil }, nil))
 	assert.Equal(t, []string{"a/n.md"}, got)
 }
@@ -42,19 +42,13 @@ func (s *Store) WithGraph(g graphsync.Store) *Store {
 // Write creates a brain note and returns its read-after-write handle.
 func (s *Store) Write(ctx context.Context, n capture.Note) (capture.Ref, error) {
 	content, unlinked, err := brain.StripUnresolvedLinks(s.brainDir, n.Content)
 	if err != nil {
 		return capture.Ref{}, err
 	}
 	n.Content = content
 	relPath, err := api.WriteNote(s.brainDir, api.WriteNoteOptions{
 		Content:  n.Content,
 		Filename: n.Filename,
 		Type:     n.Type,
 		Domain:   n.Domain,
 		Wing:     n.Wing,
 		Hall:     n.Hall,
 		Origin:    n.Origin,
 		WrittenBy: n.WrittenBy,
 	})
 	if err != nil {
 		return capture.Ref{}, err
@@ -63,20 +57,14 @@ func (s *Store) Write(ctx context.Context, n capture.Note) (capture.Ref, error)
 	s.indexInGraph(ctx, "brain_write", relPath)
 	_, _, hash, _ := api.ReadNote(s.brainDir, relPath)
-	return capture.Ref{ID: relPath, Path: relPath, ContentHash: hash, Unlinked: unlinked}, nil
+	return capture.Ref{ID: relPath, Path: relPath, ContentHash: hash}, nil
 }
 // Update supersedes an existing note in place. slug may be a bare slug
 // (resolved against n.Wing/n.Hall) or a full brain-relative path (when it
 // contains a slash). It never creates — a missing target is an error.
 func (s *Store) Update(ctx context.Context, slug string, n capture.Note) (capture.Ref, error) {
-	content, unlinked, err := brain.StripUnresolvedLinks(s.brainDir, n.Content)
+	opts := api.UpdateNoteOptions{Content: n.Content, Reason: n.Reason}
 	if err != nil {
 		return capture.Ref{}, err
 	}
 	n.Content = content
 	opts := api.UpdateNoteOptions{Content: n.Content, Reason: n.Reason, Origin: n.Origin, WrittenBy: n.WrittenBy}
 	if strings.Contains(slug, "/") {
 		opts.Path = slug
 	} else {
@@ -92,7 +80,7 @@ func (s *Store) Update(ctx context.Context, slug string, n capture.Note) (captur
 	}
 	s.indexInGraph(ctx, "brain_update", relPath)
-	return capture.Ref{ID: relPath, Path: relPath, ContentHash: hash, Superseded: true, Unlinked: unlinked}, nil
+	return capture.Ref{ID: relPath, Path: relPath, ContentHash: hash, Superseded: true}, nil
 }
 // Get fetches a note by id/path — the read-after-write confirmation
@@ -83,45 +83,3 @@ func TestStoreGetRoundTripsHash(t *testing.T) {
 	assert.Equal(t, "a", note.Frontmatter["wing"])
 	assert.Contains(t, note.Body, "# Body")
 }
 func TestStoreWriteUnwrapsUnresolvedWikilinks(t *testing.T) {
 	dir := t.TempDir()
 	s := brainstore.New(dir)
 	_, err := s.Write(context.Background(), capture.Note{
 		Content: "# Target\n\nbody\n", Filename: "target", Wing: "a", Hall: "facts",
 	})
 	require.NoError(t, err)
 	ref, err := s.Write(context.Background(), capture.Note{
 		Content:  "See [[target]] and [[secret-hygiene]].\n",
 		Filename: "src", Wing: "a", Hall: "facts",
 	})
 	require.NoError(t, err)
 	assert.Equal(t, []string{"secret-hygiene"}, ref.Unlinked)
 	got, err := os.ReadFile(filepath.Join(dir, "wiki/a/facts/src.md"))
 	require.NoError(t, err)
 	assert.Contains(t, string(got), "[[target]]")
 	assert.Contains(t, string(got), "and secret-hygiene.")
 	assert.NotContains(t, string(got), "[[secret-hygiene]]")
 }
 func TestStoreUpdateUnwrapsUnresolvedWikilinks(t *testing.T) {
 	dir := t.TempDir()
 	s := brainstore.New(dir)
 	_, err := s.Write(context.Background(), capture.Note{
 		Content: "old\n", Filename: "n", Wing: "a", Hall: "facts",
 	})
 	require.NoError(t, err)
 	ref, err := s.Update(context.Background(), "n", capture.Note{
 		Content: "Related: [[cad-babysit]].\n", Wing: "a", Hall: "facts", Reason: "r",
 	})
 	require.NoError(t, err)
 	assert.Equal(t, []string{"cad-babysit"}, ref.Unlinked)
 	got, err := os.ReadFile(filepath.Join(dir, "wiki/a/facts/n.md"))
 	require.NoError(t, err)
 	assert.Contains(t, string(got), "Related: cad-babysit.")
 	assert.NotContains(t, string(got), "[[cad-babysit]]")
 }
@@ -60,7 +60,6 @@ type CaptureContext struct {
 	Classification string // caller-declared level token ("" = unspecified)
 	Principal      string // server-derived (auth); audit identity
 	Origin         Zone   // server-derived trust zone; the I1 gate input
 	AuthPath       string // server-derived: "static" or "jwt"; stamped as note provenance (#145)
 }
 // Insight is one piece of session knowledge bound for the brain. A
@@ -15,10 +15,6 @@ type Ref struct {
 	Path        string
 	ContentHash string
 	Superseded  bool
 	// Unlinked names the [[wikilink]] targets the store unwrapped to plain
 	// text because they resolve to no entry. Reported rather than rejected:
 	// see brain.StripUnresolvedLinks for why the write still lands.
 	Unlinked []string
 }
 // StoredNote is a brain note fetched by Get: the read-after-write
@@ -31,20 +27,18 @@ type StoredNote struct {
 	Body        string
 }
-// Note is the brain-write payload: wing+hall are the only routing fields
+// Note is the brain-write payload. It carries both the wing/hall taxonomy
-// (the legacy type/domain params were removed — ADR-0012 / #79). Reason is
+// and the legacy type/domain fields so a single BrainStore serves both
 // capture insights and the existing MCP brain_write surface. Reason is
 // the supersede rationale, used only by Update.
 type Note struct {
 	Content  string
 	Filename string
 	Wing     string
 	Hall     string
 	Type     string
 	Domain   string
 	Reason   string
 	// Provenance (hyperguild#145) is stamped by the server from the
 	// authenticated principal, never taken from Content's frontmatter.
 	// Origin is "static", "jwt" or "unknown"; empty means "unknown".
 	Origin    string
 	WrittenBy string
 }
 // BrainStore is the brain persistence port — the shared implementation of
@@ -83,7 +83,7 @@ func (s *Service) Capture(ctx context.Context, in CaptureInput) (CaptureReceipt,
 		declared, _ = classification.ParseLevel(in.Context.Classification)
 	}
-	effective, securityEvents, escalators := s.resolveClassification(declared, in)
+	effective, securityEvents := s.resolveClassification(declared, in)
 	// Server-derived origin governs the I1 gate; a caller-asserted harness
 	// label that names a different zone is descriptive-only and logged as a
@@ -107,8 +107,8 @@ func (s *Service) Capture(ctx context.Context, in CaptureInput) (CaptureReceipt,
 			Items:                   nil, // refused before any write
 			SecurityEvents:          append(securityEvents, "I1 refusal: confidential capture via us-nexus origin"),
 		}, AuditCentral)
-		return CaptureReceipt{}, fmt.Errorf("%w: effective classification confidential through %s origin (%s)",
+		return CaptureReceipt{}, fmt.Errorf("%w: effective classification confidential through %s origin",
-			ErrSovereigntyRefused, in.Context.Origin, escalationReason(escalators))
+			ErrSovereigntyRefused, in.Context.Origin)
 	}
 	receipt := CaptureReceipt{
@@ -142,7 +142,7 @@ func (s *Service) Capture(ctx context.Context, in CaptureInput) (CaptureReceipt,
 	var landed []string
 	for i, ins := range in.Insights {
-		res, item, err := s.persistInsight(ctx, ins, in.Context)
+		res, item, err := s.persistInsight(ctx, ins)
 		receipt.Insights = append(receipt.Insights, res)
 		if err != nil {
 			receipt.Errors = append(receipt.Errors, ItemError{Item: fmt.Sprintf("insight[%d]", i), Error: err.Error()})
@@ -221,28 +221,15 @@ func (s *Service) validate(in CaptureInput) error {
 	return nil
 }
-// resolveClassification computes the effective level (stricter of declared
+// resolveClassification computes the effective level (stricter of
-// and every target's derived level), collects a security event whenever the
+// declared and every target's derived level) and collects a security
-// caller under-declared relative to a target floor, and names the targets
+// event whenever the caller under-declared relative to a target floor.
-// that carry the strictest level.
+func (s *Service) resolveClassification(declared classification.Level, in CaptureInput) (classification.Level, []string) {
 //
 // That third return is what makes an I1 refusal actionable. A caller sending
 // twenty tickets gets one refusal; without the offending target it cannot
 // tell which repo tripped the gate, and infra#265 shows what happens next —
 // the caller concluded the tickets ARRAY was broken, built a fallback of
 // twenty individual calls, and filed a bug against the wrong thing.
 func (s *Service) resolveClassification(declared classification.Level, in CaptureInput) (classification.Level, []string, []string) {
 	effective := declared
 	var events []string
 	derivedFor := map[string]classification.Level{}
 	var order []string
 	consider := func(kind classification.TargetKind, name string) {
 		derived := s.policy.Derive(classification.Target{Kind: kind, Name: name})
 		effective = classification.Stricter(effective, derived)
 		if _, seen := derivedFor[name]; !seen {
 			derivedFor[name] = derived
 			order = append(order, name)
 		}
 		if declared < derived {
 			events = append(events, fmt.Sprintf("classification under-declared: declared=%s target=%s(%s) derived=%s",
 				declared, name, kindString(kind), derived))
@@ -254,35 +241,11 @@ func (s *Service) resolveClassification(declared classification.Level, in Captur
 	for _, tk := range in.Tickets {
 		consider(classification.RepoTarget, tk.Repo)
 	}
-
+	return effective, events
 	// Only targets that actually reach the effective level are named: at
 	// twenty tickets, listing the innocent ones is noise that hides the one
 	// that matters.
 	var escalators []string
 	for _, name := range order {
 		if derivedFor[name] == effective && effective > declared {
 			escalators = append(escalators, name)
 		}
 	}
 	return effective, events, escalators
 }
-// escalationReason renders why the effective classification landed where it
+func (s *Service) persistInsight(ctx context.Context, ins Insight) (InsightResult, string, error) {
-// did, for an operator reading a refusal. Naming the caller's own declaration
+	note := Note{Content: ins.Text, Wing: ins.Wing, Hall: ins.Hall, Filename: brain.Sanitise(firstLine(ins.Text))}
 // matters as much as naming a target: "you asked for this" and "a repo you
 // touched required it" call for different fixes.
 func escalationReason(escalators []string) string {
 	if len(escalators) == 0 {
 		return "declared by the caller; no target required it"
 	}
 	return "required by: " + strings.Join(escalators, ", ")
 }
 func (s *Service) persistInsight(ctx context.Context, ins Insight, cc CaptureContext) (InsightResult, string, error) {
 	note := Note{
 		Content: ins.Text, Wing: ins.Wing, Hall: ins.Hall, Filename: brain.Sanitise(firstLine(ins.Text)),
 		Origin: cc.AuthPath, WrittenBy: cc.Principal,
 	}
 	var ref Ref
 	var err error
 	if ins.SupersedeSlug != "" {
@@ -3,7 +3,6 @@ package capture
 import (
 	"context"
 	"errors"
 	"fmt"
 	"strings"
 	"testing"
 	"time"
@@ -60,18 +59,12 @@ type fakeTracker struct {
 	closed   []int
 	comments []int
 	err      error
 	// failOnTitle makes CreateIssue fail for one specific title, so a
 	// partial-failure receipt can be exercised without failing every item.
 	failOnTitle string
 }
 func (f *fakeTracker) CreateIssue(_ context.Context, repo, title, _ string) (IssueRef, error) {
 	if f.err != nil {
 		return IssueRef{}, f.err
 	}
 	if f.failOnTitle != "" && title == f.failOnTitle {
 		return IssueRef{}, errors.New("tracker refused this one")
 	}
 	f.created = append(f.created, repo+":"+title)
 	return IssueRef{Repo: repo, Number: 100 + len(f.created), URL: "https://git/" + repo + "/issues/x"}, nil
 }
@@ -94,9 +87,7 @@ func (f *fakeTracker) CommentIssue(_ context.Context, repo string, number int, _
 // fakePolicy derives from an explicit map; default Internal so tests pin
 // behaviour without depending on the real defaulting.
-type fakePolicy struct {
+type fakePolicy struct{ tags map[string]classification.Level }
 	tags map[string]classification.Level
 }
 func (p fakePolicy) Derive(t classification.Target) classification.Level {
 	if lvl, ok := p.tags[t.Name]; ok {
@@ -443,98 +434,3 @@ func TestCaptureDryRunSkipsAuditGate(t *testing.T) {
 	assert.True(t, rec.DryRun)
 	assert.Empty(t, au.entries)
 }
 // ---- hyperguild#91 part 1 -------------------------------------------------
 //
 // The reported symptom was "capture with a tickets array fails" (infra#265:
 // 20 tickets errored, 5 errored, caller fell back to 20 individual
 // issue_create calls). The array was never the failing dimension — every
 // ticket targeted a client repo, and the I1 gate refuses that through a
 // us-nexus origin at ANY length. The refusal did not say which target
 // escalated the classification, so it read as a malfunction.
 func TestCapture_TicketsArrayWorksAtLengthOne(t *testing.T) {
 	b, tr, au := &fakeBrain{}, &fakeTracker{}, &fakeAudit{}
 	svc := newSvc(b, tr, fakePolicy{}, au)
 	rec, err := svc.Capture(context.Background(), CaptureInput{
 		Context: baseCtx(),
 		Tickets: []Ticket{{Repo: "hyperguild", Action: "create", Title: "one", Body: "b"}},
 	})
 	require.NoError(t, err)
 	require.Len(t, rec.Tickets, 1)
 	assert.True(t, rec.Tickets[0].OK)
 	assert.Len(t, tr.created, 1)
 	assert.Empty(t, rec.Errors)
 }
 func TestCapture_TicketsArrayWorksAtLengthMany(t *testing.T) {
 	b, tr, au := &fakeBrain{}, &fakeTracker{}, &fakeAudit{}
 	svc := newSvc(b, tr, fakePolicy{}, au)
 	in := CaptureInput{Context: baseCtx()}
 	for i := range 20 {
 		in.Tickets = append(in.Tickets, Ticket{
 			Repo: "hyperguild", Action: "create", Title: fmt.Sprintf("t%02d", i), Body: "b",
 		})
 	}
 	rec, err := svc.Capture(context.Background(), in)
 	require.NoError(t, err)
 	require.Len(t, rec.Tickets, 20, "one receipt entry per ticket")
 	for i, r := range rec.Tickets {
 		assert.True(t, r.OK, "ticket %d failed: %+v", i, rec.Errors)
 	}
 	assert.Len(t, tr.created, 20)
 	assert.Empty(t, rec.Errors)
 }
 func TestCapture_OneFailingTicketDoesNotSinkTheRest(t *testing.T) {
 	// infra#265 asked explicitly: "if ticket 3 of 5 fails, what happened to
 	// 1 and 2?" They land, and the receipt says so per item.
 	b, au := &fakeBrain{}, &fakeAudit{}
 	tr := &fakeTracker{failOnTitle: "boom"}
 	svc := newSvc(b, tr, fakePolicy{}, au)
 	rec, err := svc.Capture(context.Background(), CaptureInput{
 		Context: baseCtx(),
 		Tickets: []Ticket{
 			{Repo: "hyperguild", Action: "create", Title: "ok-1", Body: "b"},
 			{Repo: "hyperguild", Action: "create", Title: "boom", Body: "b"},
 			{Repo: "hyperguild", Action: "create", Title: "ok-3", Body: "b"},
 		},
 	})
 	require.NoError(t, err, "a per-item failure is a partial receipt, not a call error")
 	require.Len(t, rec.Tickets, 3)
 	assert.True(t, rec.Tickets[0].OK)
 	assert.False(t, rec.Tickets[1].OK)
 	assert.True(t, rec.Tickets[2].OK)
 	require.Len(t, rec.Errors, 1)
 	assert.Contains(t, rec.Errors[0].Item, "ticket[1]")
 }
 func TestCapture_I1RefusalNamesWhatEscalatedTheClassification(t *testing.T) {
 	// The actual defect behind infra#265. Without the offending target in
 	// the message, a caller with 20 tickets cannot tell which repo tripped
 	// the gate — and reasonably concludes the array itself is broken.
 	b, tr, au := &fakeBrain{}, &fakeTracker{}, &fakeAudit{}
 	pol := fakePolicy{tags: map[string]classification.Level{"trucker-ecommerce": classification.Confidential}}
 	svc := newSvc(b, tr, pol, au)
 	ctx := baseCtx()
 	ctx.Origin = ZoneUSNexus
 	_, err := svc.Capture(context.Background(), CaptureInput{
 		Context: ctx,
 		Tickets: []Ticket{
 			{Repo: "hyperguild", Action: "create", Title: "fine", Body: "b"},
 			{Repo: "trucker-ecommerce", Action: "create", Title: "client work", Body: "b"},
 		},
 	})
 	require.ErrorIs(t, err, ErrSovereigntyRefused)
 	assert.Contains(t, err.Error(), "trucker-ecommerce",
 		"the refusal must name the target that escalated the classification")
 	assert.NotContains(t, err.Error(), "hyperguild",
 		"only the offending target, or the message is noise at 20 tickets")
 	assert.Empty(t, tr.created, "refused before any write")
 }
@@ -104,10 +104,6 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	// caller may have tried to put in the body.
 	in.Context.Principal = principal
 	in.Context.Origin = h.resolver.Resolve(principal, viaStatic)
 	in.Context.AuthPath = "jwt"
 	if viaStatic {
 		in.Context.AuthPath = "static"
 	}
 	rec, err := h.svc.Capture(r.Context(), in)
 	switch {
@@ -38,11 +38,9 @@ func (f fakeTracker) CreateIssue(context.Context, string, string, string) (captu
 	}
 	return capture.IssueRef{Repo: "hyperguild", Number: 1, URL: "https://git/1"}, nil
 }
 func (fakeTracker) CloseIssue(context.Context, string, int, string) (capture.IssueRef, error) {
 	return capture.IssueRef{}, nil
 }
 func (fakeTracker) CommentIssue(context.Context, string, int, string) (capture.IssueRef, error) {
 	return capture.IssueRef{}, nil
 }
@@ -185,7 +183,6 @@ type refusingAudit struct{}
 func (refusingAudit) Reserve(context.Context, classification.Level) (capture.AuditOutcome, error) {
 	return 0, errors.New("central audit sink unreachable")
 }
 func (refusingAudit) Record(context.Context, capture.AuditEntry, capture.AuditOutcome) error {
 	return nil
 }
@@ -1,51 +0,0 @@
 package capturehttp_test
 import (
 	"os"
 	"path/filepath"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/audit"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/brainstore"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/capture"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/capturehttp"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/classification"
 )
 // The REST capture door derives AuthPath itself (hyperguild#145); a body
 // field cannot set it, and static vs JWT are told apart.
 func TestRESTCaptureStampsAuthPathFromAuthentication(t *testing.T) {
 	for _, tc := range []struct {
 		name, authz, wantOrigin, wantBy string
 		v                               capturehttp.Validator
 		sovereign                       []string
 	}{
 		{"static", "Bearer " + staticTok, "origin: static\n", "written_by: local-cli\n", nil, nil},
 		{"jwt", "Bearer jwt", "origin: jwt\n", "written_by: koala-cli\n", fakeValidator{subject: "koala-cli"}, []string{"koala-cli"}},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			brainDir := t.TempDir()
 			cfg, err := classification.Load(t.TempDir())
 			require.NoError(t, err)
 			svc := capture.NewService(brainstore.New(brainDir), fakeTracker{}, cfg, audit.NewSlogSink(nil))
 			h := capturehttp.New(svc, tc.v, staticTok, "local-cli", capturehttp.NewOriginResolver(tc.sovereign))
 			rr := do(t, h, tc.authz, map[string]any{
 				"context": map[string]any{
 					"harness": "claude-code", "actor": "mathias", "classification": "internal",
 					"AuthPath": "static", "auth_path": "static", "principal": "local-cli",
 				},
 				"insights": []map[string]any{{"text": "rest provenance probe", "wing": "hyperguild", "hall": "facts"}},
 			})
 			require.Equal(t, 200, rr.Code, rr.Body.String())
 			matches, _ := filepath.Glob(filepath.Join(brainDir, "wiki/hyperguild/facts/*.md"))
 			require.Len(t, matches, 1)
 			b, err := os.ReadFile(matches[0])
 			require.NoError(t, err)
 			assert.Contains(t, string(b), tc.wantOrigin)
 			assert.Contains(t, string(b), tc.wantBy)
 		})
 	}
 }
@@ -1,98 +0,0 @@
 // Package claim validates the claim-property frontmatter that says when and
 // where a note's claim holds, and who decided that (brain#21).
 //
 // Two families were designed together and land separately. This is the
 // applicability envelope:
 //
 //	half_life:        volatile | seasonal | durable   — how fast it decays
 //	applies:          local | homelab | universal     — how widely it holds
 //	claim_provenance: asserted | inferred             — who set the above
 //
 // The strength family (confidence, contested) follows once the ingest-time
 // contradiction detector exists to populate it.
 //
 // Why the envelope is validated rather than merely accepted: a value outside
 // the enum is worse than an absent one. A lint skips what it cannot parse, so
 // the note reads as classified while nothing acts on it — the field becomes
 // decoration that suppresses the very review it was added to trigger.
 //
 // Why `applies` and not `scope`: `scope:` has been in use since brain#5 for
 // glossary terms (`homelab-core`, `project:<repo>`) — a disjoint value space
 // on the same key. The shipped schema keeps the name; this one takes another.
 package claim
 import (
 	"fmt"
 	"strings"
 )
 // Field names, exported so writers and lints agree on the spelling.
 const (
 	FieldHalfLife   = "half_life"
 	FieldApplies    = "applies"
 	FieldProvenance = "claim_provenance"
 )
 var (
 	halfLives   = []string{"volatile", "seasonal", "durable"}
 	appliesTo   = []string{"local", "homelab", "universal"}
 	provenances = []string{"asserted", "inferred"}
 )
 // ValidateEnvelope checks the envelope fields of one note's frontmatter.
 //
 // Absent fields are valid: the envelope is opt-in for new writes, and a
 // corpus-wide backfill is deliberately out of scope (brain#21) — inferring
 // 1113 notes' properties in bulk has the same failure mode as the extraction
 // pass that produced 28 wrong wikilinks out of 67.
 func ValidateEnvelope(fm map[string]string) error {
 	halfLife, hasHalfLife := present(fm, FieldHalfLife)
 	applies, hasApplies := present(fm, FieldApplies)
 	prov, hasProv := present(fm, FieldProvenance)
 	if hasHalfLife {
 		if err := oneOf(FieldHalfLife, halfLife, halfLives); err != nil {
 			return err
 		}
 	}
 	if hasApplies {
 		if err := oneOf(FieldApplies, applies, appliesTo); err != nil {
 			return err
 		}
 	}
 	if hasProv {
 		if err := oneOf(FieldProvenance, prov, provenances); err != nil {
 			return err
 		}
 	}
 	// The field and its provenance travel together or not at all. A value
 	// whose author is unknown cannot be trusted differently from one Mathias
 	// asserted, which is how an inferred guess hardens into accepted fact.
 	switch {
 	case (hasHalfLife || hasApplies) && !hasProv:
 		return fmt.Errorf("%s is required when %s or %s is set",
 			FieldProvenance, FieldHalfLife, FieldApplies)
 	case hasProv && !hasHalfLife && !hasApplies:
 		return fmt.Errorf("%s is set but neither %s nor %s is",
 			FieldProvenance, FieldHalfLife, FieldApplies)
 	}
 	return nil
 }
 // present reports a trimmed field value and whether it was set to anything
 // non-empty. A key written with an empty value is treated as absent rather
 // than as an error: that is a caller emitting a placeholder, not asserting.
 func present(fm map[string]string, key string) (string, bool) {
 	v := strings.TrimSpace(fm[key])
 	return v, v != ""
 }
 func oneOf(field, value string, allowed []string) error {
 	for _, a := range allowed {
 		if a == value {
 			return nil
 		}
 	}
 	return fmt.Errorf("%s: %q is not one of %s", field, value, strings.Join(allowed, ", "))
 }
@@ -1,89 +0,0 @@
 // Package claim_test covers the claim-property envelope (brain#21).
 package claim_test
 import (
 	"testing"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/claim"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 func TestValidateEnvelope(t *testing.T) {
 	tests := []struct {
 		name    string
 		fm      map[string]string
 		wantErr string
 	}{
 		{
 			name: "absent is fine — the fields are opt-in on new writes",
 			fm:   map[string]string{"wing": "homelab", "hall": "facts"},
 		},
 		{
 			name: "complete envelope with provenance",
 			fm: map[string]string{
 				"half_life": "durable", "applies": "universal", "claim_provenance": "asserted",
 			},
 		},
 		{
 			name: "inferred provenance is equally valid — it just must be stated",
 			fm: map[string]string{
 				"half_life": "volatile", "applies": "local", "claim_provenance": "inferred",
 			},
 		},
 		{
 			// A value nobody can act on is worse than no value: a lint
 			// silently skips it, so the note looks classified and isn't.
 			name:    "unknown half_life value",
 			fm:      map[string]string{"half_life": "forever", "claim_provenance": "asserted"},
 			wantErr: `half_life: "forever" is not one of volatile, seasonal, durable`,
 		},
 		{
 			name:    "unknown applies value",
 			fm:      map[string]string{"applies": "galaxy", "claim_provenance": "asserted"},
 			wantErr: `applies: "galaxy" is not one of local, homelab, universal`,
 		},
 		{
 			// brain#21: a value a model inferred must never be
 			// indistinguishable from one Mathias asserted. Writing the field
 			// without saying who set it is exactly that laundering.
 			name:    "envelope field without provenance",
 			fm:      map[string]string{"half_life": "durable"},
 			wantErr: "claim_provenance is required when half_life or applies is set",
 		},
 		{
 			name:    "applies without provenance",
 			fm:      map[string]string{"applies": "homelab"},
 			wantErr: "claim_provenance is required when half_life or applies is set",
 		},
 		{
 			name:    "unknown provenance value",
 			fm:      map[string]string{"half_life": "durable", "claim_provenance": "probably"},
 			wantErr: `claim_provenance: "probably" is not one of asserted, inferred`,
 		},
 		{
 			// Provenance alone says who set fields that aren't there.
 			name:    "provenance without any envelope field",
 			fm:      map[string]string{"claim_provenance": "asserted"},
 			wantErr: "claim_provenance is set but neither half_life nor applies is",
 		},
 		{
 			// The glossary wing has used scope: homelab-core since #5. The
 			// envelope deliberately does NOT claim that key (brain#21).
 			name: "glossary scope is untouched",
 			fm:   map[string]string{"scope": "homelab-core", "term": "koala"},
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			err := claim.ValidateEnvelope(tt.fm)
 			if tt.wantErr == "" {
 				assert.NoError(t, err)
 				return
 			}
 			require.Error(t, err)
 			assert.Contains(t, err.Error(), tt.wantErr)
 		})
 	}
 }
@@ -43,26 +43,6 @@ var DefaultRules = []Rule{
 	// JSON, so both segments begin with "eyJ".
 	{Name: "jwt", RE: regexp.MustCompile(`eyJ[A-Za-z0-9_\-]{8,}\.eyJ[A-Za-z0-9_\-]{8,}\.[A-Za-z0-9_\-]{8,}`)},
 	{Name: "postgres-uri-with-password", RE: regexp.MustCompile(`postgres(?:ql)?://[^:\s/]+:[^@\s/]+@`)},
 	// Any credential embedded in a URL's userinfo, which is what a git credential
 	// store holds: `https://<user>:<token>@host`. The postgres rule above is the
 	// same shape narrowed to one scheme, and is kept ahead of this one only so a
 	// DSN reports the more specific name -- same ordering convention as
 	// authorization-header before bearer-token.
 	//
 	// Added after this shape passed ALL rules and was therefore ingested rather
 	// than dropped (hyperguild#142). It reached ~/.claude/projects -- this
 	// watcher's own input -- because a test suite in mathias/infra executed a
 	// script that configures git while inheriting the operator's real $HOME, read
 	// koala's live credential store, and printed it. Two credentials were rotated
 	// (infra#466). The scrubber is the control that decides whether that class of
 	// mistake is survivable, and for this shape it was failing open.
 	//
 	// The {8,} floor on the secret half is what keeps `https://host:443/path` and
 	// `https://user:@host` out; the `[^:\s/@]+` user half stops a host:port pair
 	// being read as userinfo. Both directions are covered by
 	// TestScrub_URLUserinfoCredential, because a rule that dropped every URL with
 	// a colon in it would discard most of the signal this watcher exists to keep.
 	{Name: "url-userinfo-credential", RE: regexp.MustCompile(`[a-zA-Z][a-zA-Z0-9+.\-]*://[^:\s/@]+:[^@\s/]{8,}@`)},
 	{Name: "private-key", RE: regexp.MustCompile(`-----BEGIN[^-]*PRIVATE KEY-----`)},
 	{Name: "ssh-key", RE: regexp.MustCompile(`ssh-(?:rsa|ed25519|ecdsa)\s+[A-Za-z0-9+/=]{40,}`)},
 	{Name: "github-pat", RE: regexp.MustCompile(`\b(?:ghp|gho|ghu|ghr|gha)_[A-Za-z0-9]{30,}\b`)},
@@ -46,64 +46,6 @@ func TestScrub_PoisonedFixtures(t *testing.T) {
 	}
 }
 // A credential embedded in a URL's userinfo is the shape a git credential store
 // holds -- `https://<user>:<token>@host` -- and it walked past every rule until
 // hyperguild#142. There was a rule for `postgres://user:pass@` and nothing for the
 // general form, so `~/.git-credentials` content was ingested rather than dropped.
 //
 // Found the hard way: a test suite in mathias/infra executed a script that
 // configures git while inheriting the operator's real $HOME, read koala's live
 // credential store, and printed two live credentials into a session transcript.
 // ~/.claude/projects is this watcher's own input, so the scrubber was the last
 // line of defence for that mistake and it failed open. Two credentials were
 // rotated (infra#466).
 //
 // The lesson is not "do not read the credential file" -- that mistake will recur.
 // It is that this shape must fail closed, because the scrubber is what decides
 // whether such a mistake is survivable.
 func TestScrub_URLUserinfoCredential(t *testing.T) {
 	// Every secret below is INVENTED. None is or was a real credential.
 	mustScrub := []struct {
 		name    string
 		content string
 	}{
 		{"git-credential-store-user", "https://mathias:0123456789abcdef0123456789abcdef01234567@git.d-ma.be"},
 		{"git-credential-store-oauth2", "https://oauth2:0123456789abcdef0123456789abcdef01234567@git.d-ma.be"},
 		{"in-context-payload-line", `payload line: https://mathias:0123456789abcdef0123456789abcdef01234567@git.d-ma.be`},
 		{"clone-url-in-argv", "git clone https://oauth2:abcdefghijklmnopqrstuvwx@git.d-ma.be/mathias/infra.git"},
 		{"http-not-https", "http://admin:supersecretvalue123@10.0.1.20/api"},
 		{"git-plus-ssh-scheme", "git+ssh://deploy:abcdefghijklmnop@example.com/repo"},
 		{"redis-scheme", "redis://default:abcdefghijklmnopqrst@10.0.1.20:6379/0"},
 	}
 	for _, tc := range mustScrub {
 		t.Run(tc.name, func(t *testing.T) {
 			assert.NotEmpty(t, Scrub(tc.content),
 				"a credential in URL userinfo must be dropped, not ingested")
 		})
 	}
 	// The other direction matters as much: a rule that scrubs every URL with a
 	// colon in it would drop most of the signal this watcher exists to keep.
 	mustNotScrub := []struct {
 		name    string
 		content string
 	}{
 		{"host-with-port", "cloning https://git.d-ma.be:443/mathias/infra.git"},
 		{"postgres-no-password", "postgres://localhost:5432/brain"},
 		{"url-with-colon-in-query", "GET https://example.com/path?filter=a:b&x=1"},
 		{"plain-url", "see https://git.d-ma.be/mathias/infra/issues/466"},
 		{"userinfo-no-secret", "https://user:@example.com"},
 		{"format-string-placeholder", `printf 'https://oauth2:%s@%s\n' "$TOKEN" "$HOST"`},
 		{"scheme-relative-time", "duration https://example.com took 00:03:22"},
 	}
 	for _, tc := range mustNotScrub {
 		t.Run(tc.name, func(t *testing.T) {
 			assert.Empty(t, Scrub(tc.content),
 				"this is not a credential and must pass through")
 		})
 	}
 }
 func TestScrub_CleanContentPassesThrough(t *testing.T) {
 	cases := []string{
 		"",
@@ -1,231 +0,0 @@
 package claudewatcher
 import (
 	"context"
 	"log/slog"
 	"os"
 	"path/filepath"
 	"strings"
 	"sync"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 // recordingHandler captures log records so a test can assert that a file was
 // never even attempted — the absence of a read error is the evidence.
 type recordingHandler struct {
 	mu      sync.Mutex
 	records []string
 }
 func (h *recordingHandler) Enabled(context.Context, slog.Level) bool { return true }
 func (h *recordingHandler) Handle(_ context.Context, r slog.Record) error {
 	h.mu.Lock()
 	defer h.mu.Unlock()
 	var sb strings.Builder
 	sb.WriteString(r.Message)
 	r.Attrs(func(a slog.Attr) bool {
 		sb.WriteString(" " + a.Key + "=" + a.Value.String())
 		return true
 	})
 	h.records = append(h.records, sb.String())
 	return nil
 }
 func (h *recordingHandler) WithAttrs([]slog.Attr) slog.Handler { return h }
 func (h *recordingHandler) WithGroup(string) slog.Handler      { return h }
 func (h *recordingHandler) contains(substr string) bool {
 	h.mu.Lock()
 	defer h.mu.Unlock()
 	for _, r := range h.records {
 		if strings.Contains(r, substr) {
 			return true
 		}
 	}
 	return false
 }
 func session(t *testing.T, root, project, id string) string {
 	t.Helper()
 	dir := filepath.Join(root, project)
 	require.NoError(t, os.MkdirAll(dir, 0o755))
 	return writeSession(t, dir, id, []string{
 		`{"type":"user","sessionId":"` + id + `","message":"a prompt"}`,
 		`{"type":"assistant","sessionId":"` + id + `","message":{"content":[{"type":"text","text":"an answer"}]}}`,
 	})
 }
 // A named project is not ingested, and its neighbours still are.
 func TestSkipProjects_skipsTheNamedProjectOnly(t *testing.T) {
 	tmp := t.TempDir()
 	session(t, tmp, "-home-mathias-dev-AGENTS-cobalt-dingo", "skipped")
 	session(t, tmp, "-home-mathias-dev", "kept")
 	sink := &memSink{}
 	require.NoError(t, TickOnce(context.Background(), Config{
 		SessionsDir:  tmp,
 		Host:         "koala",
 		Sink:         sink,
 		SkipProjects: []string{"-home-mathias-dev-AGENTS-cobalt-dingo"},
 	}))
 	require.Len(t, sink.batches, 1)
 	assert.Equal(t, "kept", sink.batches[0].SessionID)
 	assert.Equal(t, "-home-mathias-dev", sink.batches[0].ProjectID)
 }
 // Globs are necessary, not a convenience. A project directory is derived from
 // the session's WORKING DIRECTORY, so a git worktree produces an ephemeral
 // name like "-home-mathias-dev--claude-worktrees-bridge-cse-017xoC...". An
 // exact-match list could never keep up with those.
 func TestSkipProjects_globMatchesEphemeralWorktreeNames(t *testing.T) {
 	tmp := t.TempDir()
 	session(t, tmp, "-home-mathias-dev--claude-worktrees-bridge-cse-017xoCEcrc35", "worktree")
 	session(t, tmp, "-home-mathias-dev", "kept")
 	sink := &memSink{}
 	require.NoError(t, TickOnce(context.Background(), Config{
 		SessionsDir:  tmp,
 		Host:         "koala",
 		Sink:         sink,
 		SkipProjects: []string{"*claude-worktrees-bridge-cse*"},
 	}))
 	require.Len(t, sink.batches, 1)
 	assert.Equal(t, "kept", sink.batches[0].SessionID)
 }
 // The point of skipping at the directory walk: the file is never OPENED, so
 // its content never enters this process. Proven by making it unreadable — a
 // skipped file produces no read error because nothing tried to read it, while
 // the same file in a non-skipped project does.
 func TestSkipProjects_theFileIsNeverOpened(t *testing.T) {
 	tmp := t.TempDir()
 	path := session(t, tmp, "-home-mathias-dev-AGENTS-cobalt-dingo", "unreadable")
 	require.NoError(t, os.Chmod(path, 0o000))
 	t.Cleanup(func() { _ = os.Chmod(path, 0o644) })
 	rec := &recordingHandler{}
 	sink := &memSink{}
 	require.NoError(t, TickOnce(context.Background(), Config{
 		SessionsDir:  tmp,
 		Host:         "koala",
 		Sink:         sink,
 		Logger:       slog.New(rec),
 		SkipProjects: []string{"*cobalt-dingo*"},
 	}))
 	assert.Empty(t, sink.batches)
 	assert.False(t, rec.contains("file failed"),
 		"a skipped file must not even be attempted")
 }
 // The control test for the one above: without the skip, the unreadable file IS
 // attempted and fails. Otherwise the assertion above could pass for the wrong
 // reason.
 func TestSkipProjects_withoutTheSkipTheSameFileIsAttempted(t *testing.T) {
 	tmp := t.TempDir()
 	path := session(t, tmp, "-home-mathias-dev-AGENTS-cobalt-dingo", "unreadable")
 	require.NoError(t, os.Chmod(path, 0o000))
 	t.Cleanup(func() { _ = os.Chmod(path, 0o644) })
 	rec := &recordingHandler{}
 	require.NoError(t, TickOnce(context.Background(), Config{
 		SessionsDir: tmp,
 		Host:        "koala",
 		Sink:        &memSink{},
 		Logger:      slog.New(rec),
 	}))
 	assert.True(t, rec.contains("file failed"),
 		"the unreadable file must fail when not skipped — otherwise the skip test proves nothing")
 }
 // Patterns match the project directory NAME, not the whole path. A temp
 // directory or a home directory component must not accidentally match and
 // silently disable ingestion.
 func TestSkipProjects_matchesTheProjectNameNotTheFullPath(t *testing.T) {
 	tmp := t.TempDir()
 	session(t, tmp, "-home-mathias-dev", "kept")
 	sink := &memSink{}
 	require.NoError(t, TickOnce(context.Background(), Config{
 		SessionsDir: tmp,
 		Host:        "koala",
 		Sink:        sink,
 		// tmp is somewhere under /tmp; this must not match the project name.
 		SkipProjects: []string{"*tmp*"},
 	}))
 	require.Len(t, sink.batches, 1, "a path component outside the project name must not match")
 }
 // An unparseable pattern must stop the watcher rather than be ignored. A
 // silently dropped skip rule means ingesting what was meant to be excluded,
 // which is the failure that cannot be noticed after the fact.
 func TestSkipProjects_invalidPatternRefusesToRun(t *testing.T) {
 	tmp := t.TempDir()
 	session(t, tmp, "-home-mathias-dev", "kept")
 	sink := &memSink{}
 	err := TickOnce(context.Background(), Config{
 		SessionsDir:  tmp,
 		Host:         "koala",
 		Sink:         sink,
 		SkipProjects: []string{"[unclosed"},
 	})
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "[unclosed")
 	assert.Empty(t, sink.batches, "nothing may be ingested while a skip rule is broken")
 }
 func TestSkipProjects_emptyListChangesNothing(t *testing.T) {
 	tmp := t.TempDir()
 	session(t, tmp, "-home-mathias-dev", "kept")
 	sink := &memSink{}
 	require.NoError(t, TickOnce(context.Background(), Config{
 		SessionsDir: tmp, Host: "koala", Sink: sink, SkipProjects: nil,
 	}))
 	require.Len(t, sink.batches, 1)
 }
 // The difference between SkipDir and filtering after the walk, made
 // observable: an unreadable skipped directory must not disturb anything.
 //
 // Without SkipDir, WalkDir reads the directory's entries, gets a permission
 // error, and that error aborts the ENTIRE walk — so one skipped project with
 // awkward permissions would silently stop ingesting every other project.
 // Returning SkipDir means its contents are never listed at all.
 //
 // Added after a mutation test showed the earlier assertions could not tell the
 // two implementations apart.
 func TestSkipProjects_anUnreadableSkippedDirDoesNotBreakTheWalk(t *testing.T) {
 	tmp := t.TempDir()
 	session(t, tmp, "-home-mathias-dev", "kept")
 	blocked := filepath.Join(tmp, "-home-mathias-dev-AGENTS-cobalt-dingo")
 	require.NoError(t, os.MkdirAll(blocked, 0o755))
 	_ = writeSession(t, blocked, "secret", []string{
 		`{"type":"user","sessionId":"secret","message":"should never be read"}`,
 	})
 	require.NoError(t, os.Chmod(blocked, 0o000))
 	t.Cleanup(func() { _ = os.Chmod(blocked, 0o755) })
 	sink := &memSink{}
 	require.NoError(t, TickOnce(context.Background(), Config{
 		SessionsDir:  tmp,
 		Host:         "koala",
 		Sink:         sink,
 		SkipProjects: []string{"*cobalt-dingo*"},
 	}))
 	require.Len(t, sink.batches, 1, "an unreadable skipped directory must not abort the walk")
 	assert.Equal(t, "kept", sink.batches[0].SessionID)
 }
@@ -45,25 +45,6 @@ type Config struct {
 	Sink        Sink
 	Cursors     *CursorStore
 	Logger      *slog.Logger
 	// SkipProjects excludes whole project directories from ingestion, as
 	// filepath.Match globs tested against the project directory NAME (the
 	// basename, e.g. "-home-mathias-dev"), not the full path.
 	//
 	// Globs rather than exact names because a project directory is derived
 	// from the session's working directory, so a git worktree yields an
 	// ephemeral name like
 	// "-home-mathias-dev--claude-worktrees-bridge-cse-017xoC..." that no
 	// exact-match list could keep up with.
 	//
 	// Matching directories are skipped during the directory WALK, so their
 	// files are never opened and their content never enters this process —
 	// which is a stronger property than filtering it out afterwards.
 	//
 	// An unparseable pattern stops the watcher. A silently dropped skip rule
 	// means ingesting what was meant to be excluded, and that is not
 	// noticeable after the fact.
 	SkipProjects []string
 }
 // Watch runs the polling loop until ctx is cancelled. Returns ctx.Err()
@@ -87,9 +68,6 @@ func Watch(ctx context.Context, cfg Config) error {
 	if cfg.Logger == nil {
 		cfg.Logger = slog.Default()
 	}
 	if err := validateSkipPatterns(cfg.SkipProjects); err != nil {
 		return err
 	}
 	cfg.Logger.Info("claudewatcher: started",
 		"sessions_dir", cfg.SessionsDir,
 		"host", cfg.Host,
@@ -113,7 +91,7 @@ func Watch(ctx context.Context, cfg Config) error {
 // runTick is one polling pass. Exposed (lowercase) for tests via
 // TickOnce.
 func runTick(ctx context.Context, cfg Config) {
-	files, err := listSessionFiles(cfg.SessionsDir, cfg.SkipProjects, cfg.Logger)
+	files, err := listSessionFiles(cfg.SessionsDir)
 	if err != nil {
 		cfg.Logger.Warn("claudewatcher: list session files", "err", err)
 		return
@@ -141,52 +119,17 @@ func TickOnce(ctx context.Context, cfg Config) error {
 	if cfg.Logger == nil {
 		cfg.Logger = slog.Default()
 	}
 	if err := validateSkipPatterns(cfg.SkipProjects); err != nil {
 		return err
 	}
 	runTick(ctx, cfg)
 	return nil
 }
-// validateSkipPatterns rejects a pattern filepath.Match cannot parse.
+func listSessionFiles(root string) ([]string, error) {
 //
 // Checked up front rather than per file: a bad pattern that only failed at
 // match time would be reported once per session file per tick, and — worse —
 // filepath.Match returns an error alongside a false match, so the directory
 // would be ingested while the log complained.
 func validateSkipPatterns(patterns []string) error {
 	for _, p := range patterns {
 		if _, err := filepath.Match(p, "probe"); err != nil {
 			return fmt.Errorf("invalid skip-project pattern %q: %w", p, err)
 		}
 	}
 	return nil
 }
 // skipProject reports whether a project directory name matches any pattern.
 func skipProject(name string, patterns []string) bool {
 	for _, p := range patterns {
 		// The error case is already excluded by validateSkipPatterns.
 		if ok, _ := filepath.Match(p, name); ok {
 			return true
 		}
 	}
 	return false
 }
 func listSessionFiles(root string, skip []string, log *slog.Logger) ([]string, error) {
 	var out []string
 	err := filepath.WalkDir(root, func(path string, d os.DirEntry, walkErr error) error {
 		if walkErr != nil {
 			return walkErr
 		}
 		if d.IsDir() {
 			// SkipDir, so nothing inside is even listed. The files are never
 			// opened and their content never reaches this process.
 			if path != root && skipProject(d.Name(), skip) {
 				log.Info("claudewatcher: project skipped by configuration", "project", d.Name())
 				return filepath.SkipDir
 			}
 			return nil
 		}
 		if !strings.HasSuffix(path, ".jsonl") {
@@ -1,130 +0,0 @@
 package extract
 import (
 	"go/ast"
 	"go/parser"
 	"go/token"
 	"os"
 	"path/filepath"
 	"strconv"
 	"strings"
 	"testing"
 )
 const extractPkg = "github.com/mathiasbq/hyperguild/ingestion/internal/extract"
 // parseNonTest parses every non-test Go file under the module.
 func parseNonTest(t *testing.T) map[string]*ast.File {
 	t.Helper()
 	fset := token.NewFileSet()
 	out := map[string]*ast.File{}
 	err := filepath.WalkDir(filepath.Join("..", ".."), func(p string, d os.DirEntry, err error) error {
 		if err != nil {
 			return err
 		}
 		if d.IsDir() && (d.Name() == "vendor" || d.Name() == ".git") {
 			return filepath.SkipDir
 		}
 		if d.IsDir() || !strings.HasSuffix(p, ".go") || strings.HasSuffix(p, "_test.go") {
 			return nil
 		}
 		f, perr := parser.ParseFile(fset, p, nil, 0)
 		if perr != nil {
 			return perr
 		}
 		out[filepath.ToSlash(p)] = f
 		return nil
 	})
 	if err != nil {
 		t.Fatal(err)
 	}
 	return out
 }
 // PR #156 review: reading a caller-chosen path by name reopens it after the
 // containment check (hyperguild#153 item 3). Outside this package, nothing
 // may reference extract.Text — called OR taken as a value — under whatever
 // name the package is imported (round 2: an alias and a func value slipped
 // past a plain text search).
 func TestNoPackageReferencesExtractTextOutsideExtract(t *testing.T) {
 	for path, f := range parseNonTest(t) {
 		if strings.Contains(path, "internal/extract/") {
 			continue
 		}
 		names := map[string]bool{}
 		for _, imp := range f.Imports {
 			if p, _ := strconv.Unquote(imp.Path.Value); p == extractPkg {
 				name := "extract"
 				if imp.Name != nil {
 					name = imp.Name.Name
 				}
 				if name == "." {
 					t.Errorf("%s dot-imports extract; import it by name so its use stays checkable", path)
 				}
 				names[name] = true
 			}
 		}
 		if len(names) == 0 {
 			continue
 		}
 		ast.Inspect(f, func(n ast.Node) bool {
 			if sel, ok := n.(*ast.SelectorExpr); ok {
 				if id, ok := sel.X.(*ast.Ident); ok && names[id.Name] && sel.Sel.Name == "Text" {
 					t.Errorf("%s references %s.Text; use extract.TextIn through an os.Root", path, id.Name)
 				}
 			}
 			return true
 		})
 	}
 }
 // PR #156 review round 2: the FIFO fix (open non-blocking, check the handle)
 // lives in OpenRegular, and reverting any caller to a plain Root.Open stayed
 // green. In the three raw/ reader FILES parsed below (and only those: a
 // wrapper in another file is not seen), no Open/OpenFile/ReadFile selector
 // may appear outside OpenRegular, called or taken as a method value. This is
 // a second layer; the behavioural race tests in internal/api and
 // internal/watcher are what catch a rewrite through any API (round 3).
 // osOpenAllowed names the functions in guarded files that may call os.Open*
 // on a path that is not a raw/ read.
 var osOpenAllowed = map[string]bool{
 	"internal/watcher/watcher.go:appendWatcherLog": true, // ingest log append, not a raw/ read
 	// Text reads by path; outside this package only TextIn's temp copy reaches
 	// it (TestNoPackageReferencesExtractTextOutsideExtract enforces that).
 	"internal/extract/extract.go:Text": true,
 }
 func TestRawReaderFilesUseNoOpenOrReadFileOutsideOpenRegular(t *testing.T) {
 	guarded := []string{"internal/api/rawroot.go", "internal/extract/extract.go", "internal/watcher/watcher.go"}
 	files := parseNonTest(t)
 	for _, g := range guarded {
 		var f *ast.File
 		for p, af := range files {
 			if strings.HasSuffix(p, g) {
 				f = af
 			}
 		}
 		if f == nil {
 			t.Fatalf("guarded file %s not found", g)
 		}
 		for _, decl := range f.Decls {
 			fn, ok := decl.(*ast.FuncDecl)
 			if !ok || fn.Name.Name == "OpenRegular" {
 				continue
 			}
 			ast.Inspect(fn, func(n ast.Node) bool {
 				sel, ok := n.(*ast.SelectorExpr)
 				if !ok {
 					return true
 				}
 				if sel.Sel.Name == "Open" || sel.Sel.Name == "OpenFile" || sel.Sel.Name == "ReadFile" {
 					if id, ok := sel.X.(*ast.Ident); ok && id.Name == "os" && osOpenAllowed[g+":"+fn.Name.Name] {
 						return true // a named non-raw write (the ingest log append)
 					}
 					t.Errorf("%s: %s calls .%s; raw/ reads must go through OpenRegular", g, fn.Name.Name, sel.Sel.Name)
 				}
 				return true
 			})
 		}
 	}
 }
@@ -3,10 +3,8 @@ package extract
 import (
 	"fmt"
 	"io"
 	"os"
 	"strings"
 	"syscall"
 )
 // Text reads the file at path and returns its plain-text content.
@@ -43,70 +41,3 @@ func fileExt(path string) string {
 	}
 	return ""
 }
 // TextIn is Text for a file read through an os.Root (hyperguild#153): the
 // read cannot leave the root, so a path checked earlier cannot be swapped
 // for a symlink pointing elsewhere before it is read. Formats that need an
 // external tool (pdf, docmark) are copied to a temp file from the handle
 // opened through the root, then extracted from the copy.
 func TextIn(r *os.Root, rel string) (string, error) {
 	fi, err := r.Lstat(rel)
 	if err != nil {
 		return "", fmt.Errorf("stat %s: %w", rel, err)
 	}
 	if !fi.Mode().IsRegular() {
 		return "", fmt.Errorf("%s: not a regular file", rel)
 	}
 	f, _, err := OpenRegular(r, rel)
 	if err != nil {
 		return "", fmt.Errorf("open %s: %w", rel, err)
 	}
 	defer func() { _ = f.Close() }()
 	ext := strings.ToLower(fileExt(rel))
 	switch ext {
 	case ".md", ".txt":
 		b, err := io.ReadAll(f)
 		if err != nil {
 			return "", fmt.Errorf("read %s: %w", rel, err)
 		}
 		return string(b), nil
 	case ".pdf", ".docx", ".xlsx", ".pptx", ".png", ".jpg", ".jpeg":
 		tmp, err := os.CreateTemp("", "ingest-*"+ext)
 		if err != nil {
 			return "", fmt.Errorf("temp copy: %w", err)
 		}
 		defer func() { _ = os.Remove(tmp.Name()) }()
 		if _, err := io.Copy(tmp, f); err != nil {
 			_ = tmp.Close()
 			return "", fmt.Errorf("copy %s: %w", rel, err)
 		}
 		if err := tmp.Close(); err != nil {
 			return "", fmt.Errorf("copy %s: %w", rel, err)
 		}
 		return Text(tmp.Name())
 	default:
 		return "", fmt.Errorf("unsupported file extension: %s", ext)
 	}
 }
 // OpenRegular opens rel inside r and returns it only if the OPENED handle is
 // a regular file. The open is non-blocking, so a FIFO swapped in after an
 // Lstat (PR #156 review: it hung open(2) forever) is refused promptly rather
 // than stalling the reader. Callers keep their Lstat check, which refuses
 // symlinks outright; this closes the race between that check and the open.
 func OpenRegular(r *os.Root, rel string) (*os.File, os.FileInfo, error) {
 	f, err := r.OpenFile(rel, os.O_RDONLY|syscall.O_NONBLOCK, 0)
 	if err != nil {
 		return nil, nil, err
 	}
 	fi, err := f.Stat()
 	if err != nil {
 		_ = f.Close()
 		return nil, nil, err
 	}
 	if !fi.Mode().IsRegular() {
 		_ = f.Close()
 		return nil, nil, fmt.Errorf("%s: not a regular file", rel)
 	}
 	return f, fi, nil
 }
@@ -1,64 +0,0 @@
 package extract
 import (
 	"os"
 	"path/filepath"
 	"syscall"
 	"testing"
 	"time"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 // hyperguild#153 item 3: ingest checked a path, then extract.Text reopened it
 // by name, so a file swapped for a symlink in between was followed out of
 // raw/. TextIn reads through an os.Root, which refuses to leave the root.
 func TestTextInReadsInsideTheRootAndRefusesEscapes(t *testing.T) {
 	root := t.TempDir()
 	require.NoError(t, os.WriteFile(filepath.Join(root, "ok.md"), []byte("inside"), 0o644))
 	outside := filepath.Join(t.TempDir(), "secret.md")
 	require.NoError(t, os.WriteFile(outside, []byte("SENTINEL-153-TEXTIN"), 0o644))
 	require.NoError(t, os.Symlink(outside, filepath.Join(root, "leak.md")))
 	r, err := os.OpenRoot(root)
 	require.NoError(t, err)
 	defer func() { _ = r.Close() }()
 	got, err := TextIn(r, "ok.md")
 	require.NoError(t, err)
 	assert.Equal(t, "inside", got)
 	got, err = TextIn(r, "leak.md")
 	assert.Error(t, err)
 	assert.NotContains(t, got, "SENTINEL-153-TEXTIN")
 	_, err = TextIn(r, "../"+filepath.Base(outside))
 	assert.Error(t, err)
 }
 // PR #156 review: a regular file swapped for a FIFO between Lstat and Open
 // blocked open(2) forever. OpenRegular opens non-blocking and checks the type
 // on the opened handle, so a FIFO is refused promptly instead of hanging.
 func TestOpenRegularRefusesAFIFOWithoutBlocking(t *testing.T) {
 	dir := t.TempDir()
 	require.NoError(t, syscall.Mkfifo(filepath.Join(dir, "pipe.md"), 0o644))
 	r, err := os.OpenRoot(dir)
 	require.NoError(t, err)
 	defer func() { _ = r.Close() }()
 	done := make(chan error, 1)
 	go func() {
 		f, _, err := OpenRegular(r, "pipe.md")
 		if f != nil {
 			_ = f.Close()
 		}
 		done <- err
 	}()
 	select {
 	case err := <-done:
 		assert.Error(t, err)
 	case <-time.After(2 * time.Second):
 		t.Fatal("OpenRegular blocked on a FIFO")
 	}
 }
@@ -1,167 +0,0 @@
 // Package frontmatter lints and repairs the YAML frontmatter block of a
 // markdown note.
 //
 // Notes written directly — hand-authored, or promoted from brain/raw/ — do not
 // pass through pipeline.BuildPages, so nothing quotes their scalars. A title
 // containing an unescaped ": " then produces a block that yaml.Unmarshal
 // rejects with "mapping values are not allowed here", and every consumer that
 // reads frontmatter silently skips the note.
 //
 // Fix is deliberately conservative: it only adds quoting, never reorders or
 // rewrites, and it refuses to return a document that still does not parse.
 package frontmatter
 import (
 	"bytes"
 	"fmt"
 	"regexp"
 	"strings"
 	"gopkg.in/yaml.v3"
 )
 const fence = "---"
 // Lint reports whether doc's frontmatter block parses as YAML.
 //
 // A document with no frontmatter block, or with an unterminated one, is not an
 // error: there is nothing claiming to be YAML.
 func Lint(doc []byte) error {
 	b, ok := block(doc)
 	if !ok {
 		return nil
 	}
 	var v any
 	if err := yaml.Unmarshal(b, &v); err != nil {
 		return fmt.Errorf("frontmatter: %w", err)
 	}
 	return nil
 }
 // Fix quotes unquoted scalars whose value breaks YAML parsing and returns the
 // repaired document.
 //
 // It returns (doc, false, nil) when the document already parses, and
 // (doc, false, err) when quoting cannot rescue it — an unfixable document is
 // always returned byte-identical, never half-repaired.
 func Fix(doc []byte) ([]byte, bool, error) {
 	if err := Lint(doc); err == nil {
 		return doc, false, nil
 	}
 	b, ok := block(doc)
 	if !ok {
 		// Lint only fails when there is a block, so this is unreachable in
 		// practice; return the original rather than guess.
 		return doc, false, nil
 	}
 	fixed := quoteScalars(b)
 	if bytes.Equal(fixed, b) {
 		return doc, false, fmt.Errorf("frontmatter: not repairable by quoting: %w", Lint(doc))
 	}
 	var v any
 	if err := yaml.Unmarshal(fixed, &v); err != nil {
 		return doc, false, fmt.Errorf("frontmatter: quoting did not repair the block: %w", err)
 	}
 	_, rest, _ := Split(doc)
 	out := []byte(fence + "\n")
 	out = append(out, fixed...)
 	out = append(out, []byte(fence)...)
 	out = append(out, rest...)
 	return out, true, nil
 }
 // mappingLine matches "key: value" at any indentation, capturing the prefix so
 // it can be re-emitted untouched.
 //
 // Sequence items ("- value") are deliberately not handled: "- foo: bar" is
 // valid YAML, so a document containing one does not reach Fix in the first
 // place. See the Lint table for why that gap is left open.
 var mappingLine = regexp.MustCompile(`^(\s*[A-Za-z_][\w.-]*:[ \t]+)(\S.*)$`)
 // quoteScalars single-quotes every unquoted scalar value in the block that
 // contains a colon. Values that are already quoted, or that carry YAML syntax
 // this package has no business rewriting, are left alone.
 func quoteScalars(block []byte) []byte {
 	lines := strings.Split(string(block), "\n")
 	for i, line := range lines {
 		m := mappingLine.FindStringSubmatch(line)
 		if m == nil {
 			continue
 		}
 		prefix, value := m[1], m[2]
 		if !needsQuoting(value) {
 			continue
 		}
 		lines[i] = prefix + "'" + strings.ReplaceAll(value, "'", "''") + "'"
 	}
 	return []byte(strings.Join(lines, "\n"))
 }
 // needsQuoting reports whether a scalar value has to be quoted to load as the
 // string it plainly is.
 //
 // The test is YAML's own parser rather than a pattern: ask whether the value
 // stands alone as the right-hand side of a mapping. Heuristics get this wrong
 // in both directions — `title: "Foo" — bar` opens with a quote but is not
 // quoted, and a value may contain a colon inside quotes and be perfectly fine.
 //
 // Anything that already parses is left alone, whatever it parses into — a flow
 // collection, a number, a bool. It is not broken, and quoting would change its
 // type.
 func needsQuoting(value string) bool {
 	if strings.HasPrefix(value, "|") || strings.HasPrefix(value, ">") {
 		return false // block scalar; its content is not parsed as YAML
 	}
 	var probe map[string]any
 	return yaml.Unmarshal([]byte("v: "+value+"\n"), &probe) != nil
 }
 // block returns the raw YAML between the opening and closing fences.
 func block(doc []byte) ([]byte, bool) {
 	b, _, ok := Split(doc)
 	return b, ok
 }
 // Split returns doc's frontmatter block and everything from the closing
 // fence onward (the closing fence itself excluded, its trailing newline
 // included), or ok=false if doc has no properly-fenced frontmatter.
 //
 // The canonical fence detector for this codebase (hyperguild#138): three
 // independent reimplementations of this same logic each grew their own gap
 // through separate bug-fixing before being consolidated here —
 // internal/mcp's needed a CRLF/BOM guard added after both silently defeated
 // its own HasPrefix check, and internal/api's closing-fence match had no
 // trailing-newline requirement, so a document ending in "\n---extra" with no
 // real newline after the fence was treated as validly closed. Both classes
 // are closed here, once, for every caller.
 func Split(doc []byte) (block, rest []byte, ok bool) {
 	s := strings.TrimPrefix(string(doc), "\xef\xbb\xbf")
 	s = strings.ReplaceAll(s, "\r\n", "\n")
 	if !strings.HasPrefix(s, fence+"\n") {
 		return nil, nil, false
 	}
 	body := s[len(fence)+1:]
 	idx := strings.Index(body, "\n"+fence)
 	if idx < 0 {
 		return nil, nil, false
 	}
 	// What follows the closing fence must be either a newline (a real body
 	// follows) or nothing at all (the fence is the literal end of the
 	// document — no body, not a bypass attempt). Anything else, e.g.
 	// "\n---extra", is not a valid close: an earlier version of this check
 	// accepted it, which is exactly the looser match hyperguild#138 closes.
 	after := idx + 1 + len(fence)
 	switch {
 	case after == len(body):
 		return []byte(body[:idx+1]), nil, true
 	case body[after] == '\n':
 		return []byte(body[:idx+1]), []byte(body[after:]), true
 	default:
 		return nil, nil, false
 	}
 }
@@ -1,240 +0,0 @@
 // ingestion/internal/frontmatter/frontmatter_test.go
 package frontmatter
 import (
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"gopkg.in/yaml.v3"
 )
 func TestLint(t *testing.T) {
 	tests := []struct {
 		name    string
 		doc     string
 		wantErr bool
 	}{
 		{
 			name: "no frontmatter block is not an error",
 			doc:  "# Just a heading\n\nSome body text.\n",
 		},
 		{
 			name: "quoted title parses",
 			doc:  "---\ntitle: 'Headless dispatch runs: Bash is denied'\n---\n\nbody\n",
 		},
 		{
 			name: "plain title parses",
 			doc:  "---\ntitle: A simple title\nwing: homelab\n---\n\nbody\n",
 		},
 		{
 			name:    "unquoted colon in title does not parse",
 			doc:     "---\ntitle: Headless dispatch runs: Bash is denied — use gitea MCP\nwing: homelab\n---\n\nbody\n",
 			wantErr: true,
 		},
 		{
 			// Known gap, deliberately not fixed here: this parses, but the
 			// item becomes map[string]any{"Headless dispatch": "denied"}
 			// rather than a string. It is a silent type corruption, not a
 			// parse failure, so repairing it would rewrite documents that
 			// currently load — out of scope for a lint about broken YAML.
 			name: "unquoted colon in a list item parses as a mapping, not an error",
 			doc:  "---\ntitle: Fine\naliases:\n  - Headless dispatch: denied\n---\n\nbody\n",
 		},
 		{
 			name: "unterminated frontmatter is not treated as frontmatter",
 			doc:  "---\ntitle: no closing fence\n\nbody\n",
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			err := Lint([]byte(tt.doc))
 			if tt.wantErr {
 				require.Error(t, err)
 				return
 			}
 			require.NoError(t, err)
 		})
 	}
 }
 func TestFix(t *testing.T) {
 	tests := []struct {
 		name        string
 		doc         string
 		wantChanged bool
 		wantKey     string
 		wantValue   string
 	}{
 		{
 			name:        "quotes an unquoted title containing a colon",
 			doc:         "---\ntitle: Headless dispatch runs: Bash is denied — use gitea MCP\nwing: homelab\n---\n\nbody\n",
 			wantChanged: true,
 			wantKey:     "title",
 			wantValue:   "Headless dispatch runs: Bash is denied — use gitea MCP",
 		},
 		{
 			// Parses already (see the Lint table), so Fix must leave it alone
 			// rather than rewrite a document that loads.
 			name:        "leaves a colon-bearing list item alone because it already parses",
 			doc:         "---\ntitle: Fine\naliases:\n  - Headless dispatch: denied\n---\n\nbody\n",
 			wantChanged: false,
 			wantKey:     "title",
 			wantValue:   "Fine",
 		},
 		{
 			name:        "escapes an embedded single quote when quoting",
 			doc:         "---\ntitle: Don't do this: it breaks\n---\n\nbody\n",
 			wantChanged: true,
 			wantKey:     "title",
 			wantValue:   "Don't do this: it breaks",
 		},
 		{
 			// The value opens with a double quote and then keeps going after
 			// the closing one, so YAML reads it as a quoted scalar followed by
 			// junk. Treating "starts with a quote" as "already quoted" leaves
 			// this broken forever.
 			name:        "quotes a value that only looks quoted",
 			doc:         "---\ntitle: \"Evaluation Driven Generation\" — a TDD-style scaffold\ntags: [a, b]\n---\n\nbody\n",
 			wantChanged: true,
 			wantKey:     "title",
 			wantValue:   "\"Evaluation Driven Generation\" — a TDD-style scaffold",
 		},
 		{
 			name:        "leaves an already-valid document untouched",
 			doc:         "---\ntitle: 'Already quoted: fine'\nwing: homelab\n---\n\nbody\n",
 			wantChanged: false,
 			wantKey:     "title",
 			wantValue:   "Already quoted: fine",
 		},
 		{
 			name:        "leaves a document with no frontmatter untouched",
 			doc:         "# Heading\n\nbody: with a colon\n",
 			wantChanged: false,
 		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			got, changed, err := Fix([]byte(tt.doc))
 			require.NoError(t, err)
 			assert.Equal(t, tt.wantChanged, changed)
 			if !tt.wantChanged {
 				assert.Equal(t, tt.doc, string(got), "unchanged docs must be returned byte-identical")
 			}
 			// Whatever came back must parse — that is the whole point.
 			require.NoError(t, Lint(got), "Fix must not return a document that still fails to parse")
 			if tt.wantKey == "" {
 				return
 			}
 			block, ok := block(got)
 			require.True(t, ok)
 			var m map[string]any
 			require.NoError(t, yaml.Unmarshal(block, &m))
 			assert.Equal(t, tt.wantValue, m[tt.wantKey], "the value must survive quoting unchanged")
 		})
 	}
 }
 func TestFix_LeavesStructuredValuesStructured(t *testing.T) {
 	// Only the broken scalar may be touched. A flow sequence on a neighbouring
 	// line still has to load as a sequence afterwards, not as a string.
 	doc := "---\ntitle: Broken: here\ntags: [prompting, llm]\ncount: 3\n---\n\nbody\n"
 	got, changed, err := Fix([]byte(doc))
 	require.NoError(t, err)
 	require.True(t, changed)
 	b, ok := block(got)
 	require.True(t, ok)
 	var m map[string]any
 	require.NoError(t, yaml.Unmarshal(b, &m))
 	assert.Equal(t, "Broken: here", m["title"])
 	assert.Equal(t, []any{"prompting", "llm"}, m["tags"])
 	assert.Equal(t, 3, m["count"])
 }
 func TestFix_PreservesBodyExactly(t *testing.T) {
 	body := "\nThe body has: colons, 'quotes', and\n---\na horizontal rule.\n"
 	doc := "---\ntitle: Broken: title\n---" + body
 	got, changed, err := Fix([]byte(doc))
 	require.NoError(t, err)
 	require.True(t, changed)
 	assert.True(t, len(got) > 0)
 	_, rest, ok := Split([]byte(doc))
 	require.True(t, ok)
 	_, gotRest, ok := Split(got)
 	require.True(t, ok)
 	assert.Equal(t, string(rest), string(gotRest), "the body must not be touched")
 }
 func TestFix_RefusesToReturnAnUnparseableResult(t *testing.T) {
 	// A frontmatter block that quoting cannot rescue: the structure itself is
 	// broken, not a scalar. Fix must return the original and an error rather
 	// than a half-repaired document.
 	doc := "---\ntitle: fine\n\tbad: tab-indented mapping\n  - stray list item\n---\n\nbody\n"
 	got, changed, err := Fix([]byte(doc))
 	require.Error(t, err)
 	assert.False(t, changed)
 	assert.Equal(t, doc, string(got), "an unfixable document must come back byte-identical")
 }
 // TestSplit_NormalizesCRLFBeforeFenceDetection is hyperguild#138: a note
 // whose fence lines use CRLF ("---\r\n") failed strings.HasPrefix(doc,
 // "---\n") on the precondition read in internal/mcp's independent
 // reimplementation -- encoding alone, no adversarial input, silently
 // defeated fence detection there before this consolidation. Split must
 // never repeat that.
 func TestSplit_NormalizesCRLFBeforeFenceDetection(t *testing.T) {
 	doc := "---\r\ntitle: 'n'\r\nhalf_life: durable\r\n---\r\n\r\nbody\r\n"
 	block, rest, ok := Split([]byte(doc))
 	require.True(t, ok)
 	assert.Contains(t, string(block), "half_life: durable")
 	assert.Contains(t, string(rest), "body")
 }
 // TestSplit_StripsALeadingUTF8BOM is the same mechanism one layer earlier:
 // a leading BOM (Notepad's default "UTF-8" save, PowerShell's pre-v6
 // Out-File/Set-Content) defeats the same HasPrefix check before CRLF
 // normalization even applies.
 func TestSplit_StripsALeadingUTF8BOM(t *testing.T) {
 	doc := "\xef\xbb\xbf---\ntitle: 'n'\n---\n\nbody\n"
 	block, rest, ok := Split([]byte(doc))
 	require.True(t, ok)
 	assert.Contains(t, string(block), "title: 'n'")
 	assert.Contains(t, string(rest), "body")
 }
 // TestSplit_RequiresANewlineAfterTheClosingFence closes the looser match
 // internal/api's independent reimplementation carried (strings.Index(body,
 // "\n"+fence) with no trailing-newline requirement): a document ending in
 // "\n---extra" with no newline separating the fence from what follows it is
 // not a valid closing fence and must not be treated as one.
 func TestSplit_RequiresANewlineAfterTheClosingFence(t *testing.T) {
 	doc := "---\ntitle: 'n'\n---extra-not-a-real-close"
 	_, _, ok := Split([]byte(doc))
 	assert.False(t, ok, "a fence line not followed by a newline is not a valid closing fence")
 }
 // TestSplit_AcceptsAClosingFenceThatIsTheLastBytesOfTheDocument is a
 // regression pin found in review of hyperguild#138: the fix for the
 // "\n---extra" bypass above must not also reject the legitimate case of a
 // closing fence with nothing after it at all (no trailing newline because
 // there's no body, not because a bypass is being attempted) -- this
 // package's own private split() accepted that shape before the
 // consolidation, and cmd/frontmatterlint's Lint/Fix relied on it.
 func TestSplit_AcceptsAClosingFenceThatIsTheLastBytesOfTheDocument(t *testing.T) {
 	doc := "---\ntitle: 'n'\n---"
 	block, rest, ok := Split([]byte(doc))
 	require.True(t, ok, "a closing fence at literal end-of-file, with nothing after it, is valid -- there is no body to require a newline before")
 	assert.Contains(t, string(block), "title: 'n'")
 	assert.Equal(t, "", string(rest))
 }
@@ -1,84 +0,0 @@
 // ingestion/internal/frontmatter/scan.go
 package frontmatter
 import (
 	"fmt"
 	"io/fs"
 	"os"
 	"path/filepath"
 	"strings"
 	"unicode/utf8"
 )
 // Finding is one markdown file whose frontmatter does not parse.
 type Finding struct {
 	Path     string // relative to the scanned root
 	Err      error  // why it does not parse, or why the repair was refused
 	Repaired bool   // true only when fix was requested and the file was rewritten
 }
 // Scan walks root for *.md files whose frontmatter fails to parse.
 //
 // With fix set, each finding that quoting can rescue is rewritten in place;
 // anything quoting cannot rescue is reported and left byte-identical. A file
 // that cannot be read or decoded is reported as a finding rather than aborting
 // the walk — one poisoned note must not hide the other findings.
 func Scan(root string, fix bool) ([]Finding, error) {
 	var found []Finding
 	err := filepath.WalkDir(root, func(path string, d fs.DirEntry, err error) error {
 		if err != nil {
 			return err
 		}
 		if d.IsDir() || !strings.EqualFold(filepath.Ext(path), ".md") {
 			return nil
 		}
 		rel, relErr := filepath.Rel(root, path)
 		if relErr != nil {
 			rel = path
 		}
 		doc, readErr := os.ReadFile(path)
 		if readErr != nil {
 			found = append(found, Finding{Path: rel, Err: readErr})
 			return nil
 		}
 		if !utf8.Valid(doc) {
 			found = append(found, Finding{Path: rel, Err: fmt.Errorf("not valid UTF-8")})
 			return nil
 		}
 		if lintErr := Lint(doc); lintErr == nil {
 			return nil
 		}
 		if !fix {
 			found = append(found, Finding{Path: rel, Err: Lint(doc)})
 			return nil
 		}
 		repaired, changed, fixErr := Fix(doc)
 		if fixErr != nil || !changed {
 			found = append(found, Finding{Path: rel, Err: fixErr})
 			return nil
 		}
 		if writeErr := writeFilePreservingMode(path, repaired); writeErr != nil {
 			found = append(found, Finding{Path: rel, Err: writeErr})
 			return nil
 		}
 		found = append(found, Finding{Path: rel, Repaired: true})
 		return nil
 	})
 	if err != nil {
 		return nil, fmt.Errorf("scan %s: %w", root, err)
 	}
 	return found, nil
 }
 func writeFilePreservingMode(path string, content []byte) error {
 	mode := fs.FileMode(0o644)
 	if info, err := os.Stat(path); err == nil {
 		mode = info.Mode().Perm()
 	}
 	return os.WriteFile(path, content, mode)
 }
@@ -1,103 +0,0 @@
 // ingestion/internal/frontmatter/scan_test.go
 package frontmatter
 import (
 	"os"
 	"path/filepath"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 func writeTree(t *testing.T, files map[string]string) string {
 	t.Helper()
 	root := t.TempDir()
 	for name, content := range files {
 		path := filepath.Join(root, name)
 		require.NoError(t, os.MkdirAll(filepath.Dir(path), 0o755))
 		require.NoError(t, os.WriteFile(path, []byte(content), 0o644))
 	}
 	return root
 }
 const (
 	brokenDoc = "---\ntitle: Broken: title here\nwing: homelab\n---\n\nbody\n"
 	validDoc  = "---\ntitle: 'Fine: quoted'\n---\n\nbody\n"
 )
 func TestScan_ReportsOnlyBrokenFiles(t *testing.T) {
 	root := writeTree(t, map[string]string{
 		"wiki/a/broken.md": brokenDoc,
 		"wiki/a/valid.md":  validDoc,
 		"wiki/b/plain.md":  "# no frontmatter\n\nbody: with colon\n",
 		"wiki/a/notes.txt": brokenDoc, // not markdown — must be ignored
 	})
 	found, err := Scan(root, false)
 	require.NoError(t, err)
 	require.Len(t, found, 1)
 	assert.Equal(t, "wiki/a/broken.md", found[0].Path)
 	assert.False(t, found[0].Repaired)
 	assert.Error(t, found[0].Err)
 	// Dry run must not touch the file.
 	got, err := os.ReadFile(filepath.Join(root, "wiki/a/broken.md"))
 	require.NoError(t, err)
 	assert.Equal(t, brokenDoc, string(got))
 }
 func TestScan_FixWritesRepairedFilesAndLeavesTheRestAlone(t *testing.T) {
 	root := writeTree(t, map[string]string{
 		"wiki/a/broken.md": brokenDoc,
 		"wiki/a/valid.md":  validDoc,
 	})
 	found, err := Scan(root, true)
 	require.NoError(t, err)
 	require.Len(t, found, 1)
 	assert.True(t, found[0].Repaired)
 	assert.NoError(t, found[0].Err)
 	repaired, err := os.ReadFile(filepath.Join(root, "wiki/a/broken.md"))
 	require.NoError(t, err)
 	require.NoError(t, Lint(repaired), "the repaired file must parse")
 	assert.Contains(t, string(repaired), "title: 'Broken: title here'")
 	assert.Contains(t, string(repaired), "wing: homelab", "untouched keys must survive")
 	untouched, err := os.ReadFile(filepath.Join(root, "wiki/a/valid.md"))
 	require.NoError(t, err)
 	assert.Equal(t, validDoc, string(untouched))
 	// Second pass finds nothing — the repair is idempotent and complete.
 	again, err := Scan(root, true)
 	require.NoError(t, err)
 	assert.Empty(t, again)
 }
 func TestScan_ReportsUnfixableWithoutWriting(t *testing.T) {
 	unfixable := "---\ntitle: fine\n\tbad: tab-indented\n  - stray\n---\n\nbody\n"
 	root := writeTree(t, map[string]string{"wiki/x.md": unfixable})
 	found, err := Scan(root, true)
 	require.NoError(t, err)
 	require.Len(t, found, 1)
 	assert.False(t, found[0].Repaired)
 	assert.Error(t, found[0].Err)
 	got, err := os.ReadFile(filepath.Join(root, "wiki/x.md"))
 	require.NoError(t, err)
 	assert.Equal(t, unfixable, string(got), "an unfixable file must be left exactly as it was")
 }
 func TestScan_ReportsUndecodableFilesInsteadOfFailingTheRun(t *testing.T) {
 	root := writeTree(t, map[string]string{"wiki/ok.md": validDoc})
 	require.NoError(t, os.WriteFile(filepath.Join(root, "wiki/bad-bytes.md"),
 		[]byte{'-', '-', '-', '\n', 0xff, 0xfe, '\n', '-', '-', '-', '\n'}, 0o644))
 	found, err := Scan(root, false)
 	require.NoError(t, err, "one unreadable file must not abort the whole scan")
 	require.Len(t, found, 1)
 	assert.Equal(t, "wiki/bad-bytes.md", found[0].Path)
 }
@@ -5,18 +5,14 @@ import (
 	"fmt"
 )
-// Router calls Primary first; on any error falls back to Fallback, then to
+// Router calls Primary first; on any error falls back to Fallback.
-// Tertiary. Fallback and Tertiary may each be nil — a nil tier is skipped and
+// Fallback may be nil, in which case primary errors are returned directly.
 // the chain returns the errors accumulated so far.
 type Router struct {
 	Primary  *Client
 	Fallback *Client
 	Tertiary *Client
 }
-// Complete implements pipeline.CompleteFunc, routing through Primary, then
+// Complete implements pipeline.CompleteFunc, routing through Primary then Fallback.
 // Fallback, then Tertiary — trying each configured tier in order and
 // returning the first success.
 func (r *Router) Complete(ctx context.Context, system, user string) (string, error) {
 	out, err := r.Primary.Complete(ctx, system, user)
 	if err == nil {
@@ -26,15 +22,8 @@ func (r *Router) Complete(ctx context.Context, system, user string) (string, err
 		return "", fmt.Errorf("primary llm: %w", err)
 	}
 	out, err2 := r.Fallback.Complete(ctx, system, user)
-	if err2 == nil {
+	if err2 != nil {
 		return out, nil
 	}
 	if r.Tertiary == nil {
 		return "", fmt.Errorf("primary llm: %w; fallback llm: %v", err, err2)
 	}
 	out, err3 := r.Tertiary.Complete(ctx, system, user)
 	if err3 != nil {
 		return "", fmt.Errorf("primary llm: %w; fallback llm: %v; tertiary llm: %v", err, err2, err3)
 	}
 	return out, nil
 }
@@ -69,78 +69,3 @@ func TestRouter_NilFallback(t *testing.T) {
 	_, err := r.Complete(context.Background(), "sys", "user")
 	assert.Error(t, err)
 }
 func TestRouter_FallsBackToTertiaryWhenPrimaryAndFallbackFail(t *testing.T) {
 	fail := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "unavailable", http.StatusServiceUnavailable)
 	}))
 	defer fail.Close()
 	tertiary := mockServer(t, "from-tertiary")
 	defer tertiary.Close()
 	r := &Router{
 		Primary:  New(fail.URL, "", "m", time.Second),
 		Fallback: New(fail.URL, "", "m", time.Second),
 		Tertiary: New(tertiary.URL, "", "m", time.Second),
 	}
 	out, err := r.Complete(context.Background(), "sys", "user")
 	require.NoError(t, err)
 	assert.Equal(t, "from-tertiary", out)
 }
 func TestRouter_TertiaryNotCalledWhenFallbackSucceeds(t *testing.T) {
 	fail := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "unavailable", http.StatusServiceUnavailable)
 	}))
 	defer fail.Close()
 	fallback := mockServer(t, "from-fallback")
 	defer fallback.Close()
 	tertiary := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		t.Error("tertiary must not be called when fallback succeeds")
 	}))
 	defer tertiary.Close()
 	r := &Router{
 		Primary:  New(fail.URL, "", "m", time.Second),
 		Fallback: New(fallback.URL, "", "m", time.Second),
 		Tertiary: New(tertiary.URL, "", "m", time.Second),
 	}
 	out, err := r.Complete(context.Background(), "sys", "user")
 	require.NoError(t, err)
 	assert.Equal(t, "from-fallback", out)
 }
 func TestRouter_AllThreeFail(t *testing.T) {
 	fail := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "err", http.StatusBadGateway)
 	}))
 	defer fail.Close()
 	r := &Router{
 		Primary:  New(fail.URL, "", "m", time.Second),
 		Fallback: New(fail.URL, "", "m", time.Second),
 		Tertiary: New(fail.URL, "", "m", time.Second),
 	}
 	_, err := r.Complete(context.Background(), "sys", "user")
 	assert.Error(t, err)
 	assert.Contains(t, err.Error(), "primary llm")
 	assert.Contains(t, err.Error(), "fallback llm")
 	assert.Contains(t, err.Error(), "tertiary llm")
 }
 func TestRouter_NilTertiary(t *testing.T) {
 	// Existing 2-tier deployments (no BRAIN_LLM_TERTIARY_URL) must keep working
 	// exactly as before — Tertiary is opt-in, not required.
 	fail := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "err", http.StatusBadGateway)
 	}))
 	defer fail.Close()
 	r := &Router{
 		Primary:  New(fail.URL, "", "m", time.Second),
 		Fallback: New(fail.URL, "", "m", time.Second),
 	}
 	_, err := r.Complete(context.Background(), "sys", "user")
 	assert.Error(t, err)
 	assert.NotContains(t, err.Error(), "tertiary")
 }
@@ -1,48 +0,0 @@
 package mcp
 import (
 	"context"
 	"encoding/json"
 	"log/slog"
 	"time"
 )
 // logToolCall emits one structured record per tools/call (hyperguild#144,
 // OWASP MCP08): who called which tool, against which wing/hall, and how it
 // ended. Brain content is never copied into the record — only its size — so
 // the audit trail does not become a second, unscrubbed copy of the brain.
 func logToolCall(ctx context.Context, name string, args json.RawMessage, start time.Time, err error) {
 	origin, principal := provenanceFrom(ctx)
 	attrs := []any{
 		"tool", name,
 		"principal", principal,
 		"origin", origin,
 		"duration_ms", time.Since(start).Milliseconds(),
 	}
 	var a struct {
 		Wing    string `json:"wing"`
 		Hall    string `json:"hall"`
 		Content string `json:"content"`
 	}
 	if json.Unmarshal(args, &a) == nil {
 		if a.Wing != "" {
 			attrs = append(attrs, "wing", a.Wing)
 		}
 		if a.Hall != "" {
 			attrs = append(attrs, "hall", a.Hall)
 		}
 		if a.Content != "" {
 			attrs = append(attrs, "content_bytes", len(a.Content))
 		}
 	}
 	// The outcome is a class, never the error text: handler errors echo
 	// argument values (a rejected half_life, a requested path), which would
 	// make the audit line a copy of what the caller sent (PR #147 review E6).
 	// The caller already received the full error in the tool response.
 	outcome := "ok"
 	if err != nil {
 		outcome = "error"
 	}
 	attrs = append(attrs, "outcome", outcome)
 	slog.InfoContext(ctx, "mcp tool call", attrs...)
 }
@@ -1,83 +0,0 @@
 package mcp_test
 import (
 	"bytes"
 	"encoding/json"
 	"log/slog"
 	"strings"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 // captureToolCallLog routes slog to a buffer for fn and returns the decoded
 // "mcp tool call" records.
 func captureToolCallLog(t *testing.T, fn func()) []map[string]any {
 	t.Helper()
 	var buf bytes.Buffer
 	prev := slog.Default()
 	slog.SetDefault(slog.New(slog.NewJSONHandler(&buf, nil)))
 	t.Cleanup(func() { slog.SetDefault(prev) })
 	fn()
 	var out []map[string]any
 	for _, l := range strings.Split(strings.TrimSpace(buf.String()), "\n") {
 		var rec map[string]any
 		if json.Unmarshal([]byte(l), &rec) == nil && rec["msg"] == "mcp tool call" {
 			out = append(out, rec)
 		}
 	}
 	return out
 }
 // hyperguild#144: brain_query/brain_read left no record of who read what.
 func TestToolsCallLogsOneRecordWithToolPrincipalOriginAndScope(t *testing.T) {
 	srv, _, _, _ := govServer(t)
 	recs := captureToolCallLog(t, func() {
 		authCall(t, srv, "Bearer "+capStaticTok, "brain_query",
 			map[string]any{"query": "anything", "wing": "homelab", "hall": "facts"})
 	})
 	require.Len(t, recs, 1)
 	r := recs[0]
 	assert.Equal(t, "brain_query", r["tool"])
 	assert.Equal(t, "local-cli", r["principal"])
 	assert.Equal(t, "static", r["origin"])
 	assert.Equal(t, "homelab", r["wing"])
 	assert.Equal(t, "facts", r["hall"])
 	assert.Equal(t, "ok", r["outcome"])
 	assert.Contains(t, r, "duration_ms")
 }
 func TestToolsCallWithoutDerivablePrincipalLogsOriginUnknown(t *testing.T) {
 	srv, _, _, _ := govServer(t)
 	recs := captureToolCallLog(t, func() {
 		authCall(t, srv, "", "brain_query", map[string]any{"query": "x"})
 	})
 	require.Len(t, recs, 1)
 	assert.Equal(t, "unknown", recs[0]["origin"])
 	assert.Equal(t, "", recs[0]["principal"])
 }
 func TestToolsCallLogsErrorOutcome(t *testing.T) {
 	srv, _, _, _ := govServer(t)
 	recs := captureToolCallLog(t, func() {
 		authCall(t, srv, "Bearer "+capStaticTok, "brain_query", map[string]any{})
 	})
 	require.Len(t, recs, 1)
 	assert.Equal(t, "error", recs[0]["outcome"])
 }
 // The audit line must not become a second copy of brain content.
 func TestToolsCallLogOmitsContentButRecordsItsSize(t *testing.T) {
 	const sentinel = "SENTINEL-BRAIN-CONTENT-91c2"
 	srv, _, _, _ := govServer(t)
 	recs := captureToolCallLog(t, func() {
 		authCall(t, srv, "Bearer "+capStaticTok, "brain_write", map[string]any{
 			"content": "# t\n\n" + sentinel, "wing": "testing", "hall": "facts", "filename": "audit-sentinel",
 		})
 	})
 	require.Len(t, recs, 1)
 	raw, _ := json.Marshal(recs[0])
 	assert.NotContains(t, string(raw), sentinel)
 	assert.EqualValues(t, len("# t\n\n"+sentinel), recs[0]["content_bytes"])
 }
@@ -12,10 +12,9 @@ import (
 	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/brain"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/capture"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/extract"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/graphsync"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/notes"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/pipeline"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/provenance"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/search"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/session"
 )
@@ -53,12 +52,14 @@ func (s *Server) tools() []map[string]any {
 		},
 		{
 			"name":        "brain_write",
-			"description": "Write a markdown note to brain/wiki/<wing>/<hall>/ with wing/hall/created_at frontmatter. Both wing and hall are required.",
+			"description": "Write a markdown note to the brain. With wing+hall set, routes to brain/wiki/<wing>/<hall>/ with wing/hall/created_at frontmatter; otherwise writes to brain/knowledge/ (legacy).",
-			"inputSchema": schema([]string{"content", "wing", "hall"}, map[string]any{
+			"inputSchema": schema([]string{"content"}, map[string]any{
 				"content":  str("markdown content"),
 				"filename": str("optional filename or slug"),
-				"wing":     str("topic domain, e.g. jepa-fx"),
+				"type":     str("optional frontmatter type (legacy)"),
-				"hall":     enum("memory type", halls...),
+				"domain":   str("optional frontmatter domain (legacy)"),
 				"wing":     str("optional topic domain, e.g. jepa-fx"),
 				"hall":     enum("optional memory type (requires wing)", halls...),
 			}),
 		},
 		{
@@ -96,16 +97,6 @@ func (s *Server) tools() []map[string]any {
 				"slug":     str("optional target slug; defaults to filename minus date prefix"),
 			}),
 		},
 		{
 			"name":        "brain_reject",
 			"description": "Reject a brain/raw/ note: stamps rejected_at (+ reject_reason if given) into frontmatter and moves it to brain/raw/rejected/ — never deleted outright, and never re-surfaced by brain_pending. The third option alongside promote/leave-pending; a human decision, never automatic. Returns {path}.",
 			"inputSchema": schema([]string{"filename"}, map[string]any{
 				"filename": str("basename in brain/raw/, e.g. 2026-04-23-fed-sentiment-scrape.md"),
 				"reason":   str("optional; why this isn't worth promoting"),
 			}),
 		},
 		noteToolDescriptors()[0],
 		noteToolDescriptors()[1],
 		{
 			"name":        "brain_tunnel",
 			"description": "Create an explicit bidirectional [[wikilink]] between two notes in different wings. Idempotent.",
@@ -114,6 +105,13 @@ func (s *Server) tools() []map[string]any {
 				"target": str("path of target note (must be in a different wing)"),
 			}),
 		},
 		{
 			"name":        "brain_index",
 			"description": "Regenerate _index.md (Map of Content) for one or all wings under brain/wiki/. Auto-called after brain_write with wing+hall.",
 			"inputSchema": schema([]string{}, map[string]any{
 				"wing": str("optional wing to index; if absent, rebuilds every wing"),
 			}),
 		},
 		{
 			"name":        "brain_ingest_raw",
 			"description": "Ingest pre-structured pages into the brain wiki, bypassing the LLM extraction step.",
@@ -233,19 +231,12 @@ func (s *Server) brainQuery(ctx context.Context, args json.RawMessage) (json.Raw
 type brainWriteArgs struct {
 	Content  string `json:"content"`
 	Filename string `json:"filename,omitempty"`
 	Type     string `json:"type,omitempty"`
 	Domain   string `json:"domain,omitempty"`
 	Wing     string `json:"wing,omitempty"`
 	Hall     string `json:"hall,omitempty"`
 }
 // unlinkedNote explains the `unlinked` field to the caller that caused it.
 // The write landed; what is gone is the [[...]] around a target that names no
 // brain entry. Said here rather than only in a doc comment because the caller
 // is a model that will otherwise repeat it on the next write.
 const unlinkedNote = "these [[wikilink]] targets resolve to no brain entry, " +
 	"so they were unwrapped to plain text. Link only entries that exist " +
 	"(a filename under knowledge/ or wiki/); write the target entry first if " +
 	"you want the link, and keep skills, repos and agent-local memory files as prose."
 func (s *Server) brainWrite(ctx context.Context, args json.RawMessage) (json.RawMessage, error) {
 	var a brainWriteArgs
 	if err := json.Unmarshal(args, &a); err != nil {
@@ -255,24 +246,18 @@ func (s *Server) brainWrite(ctx context.Context, args json.RawMessage) (json.Raw
 	// one implementation (capture uses the same store). The read-after-write
 	// handle {id, path, content_hash} comes back from the store; path is kept
 	// for backward compatibility.
 	origin, writtenBy := provenanceFrom(ctx)
 	ref, err := s.store.Write(ctx, capture.Note{
 		Content:  a.Content,
 		Filename: a.Filename,
 		Type:     a.Type,
 		Domain:   a.Domain,
 		Wing:     a.Wing,
 		Hall:     a.Hall,
 		Origin:    origin,
 		WrittenBy: writtenBy,
 	})
 	if err != nil {
 		return nil, err
 	}
-	out := map[string]any{"id": ref.ID, "path": ref.Path, "content_hash": ref.ContentHash}
+	return json.Marshal(map[string]string{"id": ref.ID, "path": ref.Path, "content_hash": ref.ContentHash})
 	if len(ref.Unlinked) > 0 {
 		out["unlinked"] = ref.Unlinked
 		out["unlinked_note"] = unlinkedNote
 	}
 	return json.Marshal(out)
 }
 type brainUpdateArgs struct {
@@ -307,26 +292,18 @@ func (s *Server) brainUpdate(ctx context.Context, args json.RawMessage) (json.Ra
 	if a.Path != "" {
 		slug = a.Path
 	}
 	origin, writtenBy := provenanceFrom(ctx)
 	ref, err := s.store.Update(ctx, slug, capture.Note{
 		Content: a.Content,
 		Wing:    a.Wing,
 		Hall:    a.Hall,
 		Reason:  a.Reason,
 		Origin:    origin,
 		WrittenBy: writtenBy,
 	})
 	if err != nil {
 		return nil, err
 	}
-	out := map[string]any{
+	return json.Marshal(map[string]any{
 		"id": ref.ID, "path": ref.Path, "content_hash": ref.ContentHash, "superseded": ref.Superseded,
-	}
+	})
 	if len(ref.Unlinked) > 0 {
 		out["unlinked"] = ref.Unlinked
 		out["unlinked_note"] = unlinkedNote
 	}
 	return json.Marshal(out)
 }
 type brainGetArgs struct {
@@ -350,15 +327,6 @@ func (s *Server) brainGet(ctx context.Context, args json.RawMessage) (json.RawMe
 	if target == "" {
 		return nil, fmt.Errorf("id or path is required")
 	}
 	// Containment: the store resolves any brain-relative path, and
 	// parseFrontmatter returns the WHOLE file as body when there is no
 	// frontmatter fence — so without this, brain_get reads verbatim session
 	// transcripts under archive/ and sessions/, which BM25 never indexes and
 	// which nobody therefore thinks of as reachable. Same allowlist as
 	// brain_read (brain#4).
 	if _, err := notes.Resolve(s.brainDir, target, notes.ScopeNotes); err != nil {
 		return nil, err
 	}
 	note, err := s.store.Get(ctx, target)
 	if err != nil {
 		return nil, err
@@ -393,10 +361,8 @@ func (s *Server) brainPromote(ctx context.Context, args json.RawMessage) (json.R
 	if err := json.Unmarshal(args, &a); err != nil {
 		return nil, fmt.Errorf("parse args: %w", err)
 	}
 	origin, writtenBy := provenanceFrom(ctx)
 	relPath, err := api.PromoteNote(s.brainDir, api.PromoteOptions{
 		Filename: a.Filename, Wing: a.Wing, Hall: a.Hall, Slug: a.Slug,
 		Origin: origin, WrittenBy: writtenBy,
 	})
 	if err != nil {
 		return nil, err
@@ -405,26 +371,6 @@ func (s *Server) brainPromote(ctx context.Context, args json.RawMessage) (json.R
 	return json.Marshal(map[string]string{"path": relPath})
 }
 type brainRejectArgs struct {
 	Filename string `json:"filename"`
 	Reason   string `json:"reason,omitempty"`
 }
 // brainReject records a decision not to promote a raw/ note (api.RejectNote:
 // frontmatter-stamp + move to raw/rejected/). No graph indexing — a rejected
 // note never entered the wiki, so there's nothing to index.
 func (s *Server) brainReject(_ context.Context, args json.RawMessage) (json.RawMessage, error) {
 	var a brainRejectArgs
 	if err := json.Unmarshal(args, &a); err != nil {
 		return nil, fmt.Errorf("parse args: %w", err)
 	}
 	relPath, err := api.RejectNote(s.brainDir, api.RejectOptions{Filename: a.Filename, Reason: a.Reason})
 	if err != nil {
 		return nil, err
 	}
 	return json.Marshal(map[string]string{"path": relPath})
 }
 // indexInGraph is a best-effort wrapper around graphsync.IndexDoc that
 // logs failures but never propagates them — the underlying write/ingest
 // has already succeeded and the graph is an augmentation, not a
@@ -499,7 +445,7 @@ func (s *Server) brainIngestRaw(ctx context.Context, args json.RawMessage) (json
 	if len(a.Pages) == 0 {
 		return nil, fmt.Errorf("pages must be non-empty")
 	}
-	result, err := pipeline.RunRaw(withCallerStamp(ctx), s.brainDir, a.Source, a.Pages, a.DryRun)
+	result, err := pipeline.RunRaw(s.brainDir, a.Source, a.Pages, a.DryRun)
 	if err != nil {
 		return nil, fmt.Errorf("ingest: %w", err)
 	}
@@ -542,13 +488,7 @@ func (s *Server) brainIngest(ctx context.Context, args json.RawMessage) (json.Ra
 	}
 	if a.Path != "" {
-		// Confined to brain/raw/ with symlinks evaluated (hyperguild#149).
+		text, err := extract.Text(a.Path)
 		resolved, err := api.ResolveIngestPath(s.brainDir, a.Path)
 		if err != nil {
 			return nil, err
 		}
 		a.Path = resolved
 		text, err := api.ReadIngestFile(s.brainDir, a.Path)
 		if err != nil {
 			return nil, fmt.Errorf("extract: %w", err)
 		}
@@ -604,7 +544,7 @@ func (s *Server) sessionLog(ctx context.Context, args json.RawMessage) (json.Raw
 }
 func (s *Server) runIngest(ctx context.Context, content, source string, dryRun bool) (json.RawMessage, error) {
-	result, err := pipeline.Run(withCallerStamp(ctx), s.pipeline, s.brainDir, content, source, dryRun)
+	result, err := pipeline.Run(ctx, s.pipeline, s.brainDir, content, source, dryRun)
 	if err != nil {
 		return nil, fmt.Errorf("ingest: %w", err)
 	}
@@ -623,10 +563,3 @@ func (s *Server) runIngest(ctx context.Context, content, source string, dryRun b
 	}
 	return json.Marshal(map[string]any{"pages": pages, "warnings": warnings})
 }
 // withCallerStamp attaches the caller's provenance for the ingest pipeline,
 // which stamps every page it writes or merges into (hyperguild#145).
 func withCallerStamp(ctx context.Context) context.Context {
 	origin, writtenBy := provenanceFrom(ctx)
 	return provenance.WithStamp(ctx, provenance.Stamp{Origin: origin, WrittenBy: writtenBy})
 }
@@ -51,50 +51,25 @@ func TestBrainQueryReturnsResults(t *testing.T) {
 	assert.Contains(t, text, "tdd.md")
 }
-// TestBrainWriteIgnoresLegacyTypeAndDomainParams pins the post-#79 contract:
+func TestBrainWriteCreatesFile(t *testing.T) {
 // domain/type were removed from the schema and the handler's arg struct, so
 // a caller that still sends them (the old MCP surface) gets a normal wing+
 // hall write with no error and no effect from the stale fields — silently
 // dropped by json.Unmarshal, not rejected. Only content in its OWN
 // frontmatter (unrelated to these params) can set type/domain, per
 // TestWriteNote_HallRouteMergesExistingFrontmatterInsteadOfStacking in the
 // api package.
 func TestBrainWriteIgnoresLegacyTypeAndDomainParams(t *testing.T) {
 	brainDir := t.TempDir()
 	srv := mcp.NewServer(brainDir, nil, nil, nil)
 	resp := toolCall(t, srv, "brain_write", map[string]any{
 		"content":  "# Test\n\nbody",
-		"filename": "test",
+		"filename": "test.md",
 		"wing":     "homelab",
 		"hall":     "facts",
 		"type":     "note",
 		"domain":   "personal",
 	})
 	require.Nil(t, resp["error"])
-	got, err := os.ReadFile(filepath.Join(brainDir, "wiki", "homelab", "facts", "test.md"))
+	got, err := os.ReadFile(filepath.Join(brainDir, "knowledge", "test.md"))
 	require.NoError(t, err)
-	assert.NotContains(t, string(got), "type: note")
+	assert.Contains(t, string(got), "type: note")
-	assert.NotContains(t, string(got), "domain: personal")
+	assert.Contains(t, string(got), "domain: personal")
 	assert.Contains(t, string(got), "# Test")
 }
 // TestBrainWriteRequiresWingAndHall is the MCP-tool-call counterpart of
 // api.TestWriteNote_RequiresWingAndHall: the legacy brain/knowledge/
 // fallback is gone, so a caller omitting either param gets a tool error,
 // not a silent legacy write.
 func TestBrainWriteRequiresWingAndHall(t *testing.T) {
 	brainDir := t.TempDir()
 	srv := mcp.NewServer(brainDir, nil, nil, nil)
 	resp := toolCall(t, srv, "brain_write", map[string]any{
 		"content":  "x",
 		"filename": "no-destination",
 	})
 	require.NotNil(t, resp["error"])
 }
 func TestBrainWriteWingHallRoutesToWiki(t *testing.T) {
 	brainDir := t.TempDir()
 	srv := mcp.NewServer(brainDir, nil, nil, nil)
@@ -233,11 +208,30 @@ func TestBrainTunnelRejectsMissing(t *testing.T) {
 	require.NotNil(t, resp["error"])
 }
-// Filename traversal/sanitisation on the wiki route is covered directly
+func TestBrainWriteRejectsTraversal(t *testing.T) {
-// against brain.NotePath/Sanitise in internal/brain/path_test.go
+	brainDir := t.TempDir()
-// (TestNotePath_SanitisesWingAndSlug, TestSanitise) — those tests exercised
+	srv := mcp.NewServer(brainDir, nil, nil, nil)
-// the now-deleted brain/knowledge/ legacy path's own separate filename
+
-// validation, which had no equivalent once that path was removed (#79).
+	resp := toolCall(t, srv, "brain_write", map[string]any{
 		"content":  "x",
 		"filename": "../escape.md",
 	})
 	require.NotNil(t, resp["error"])
 }
 func TestBrainWriteAcceptsDoubleDotInName(t *testing.T) {
 	brainDir := t.TempDir()
 	srv := mcp.NewServer(brainDir, nil, nil, nil)
 	resp := toolCall(t, srv, "brain_write", map[string]any{
 		"content":  "x",
 		"filename": "notes..draft.md",
 	})
 	require.Nil(t, resp["error"])
 	_, err := os.Stat(filepath.Join(brainDir, "knowledge", "notes..draft.md"))
 	require.NoError(t, err, "filename with embedded .. should be allowed")
 }
 func TestBrainIngestRawDryRun(t *testing.T) {
 	brainDir := t.TempDir()
@@ -396,38 +390,3 @@ func TestBrainPromoteInvalidHallErrors(t *testing.T) {
 	_, srcErr := os.Stat(filepath.Join(raw, "x.md"))
 	assert.NoError(t, srcErr, "source untouched on validation error")
 }
 func TestBrainRejectMovesToRejectedSubdir(t *testing.T) {
 	brainDir := t.TempDir()
 	raw := filepath.Join(brainDir, "raw")
 	require.NoError(t, os.MkdirAll(raw, 0o755))
 	require.NoError(t, os.WriteFile(filepath.Join(raw, "2026-04-23-scrape.md"),
 		[]byte("---\ncreated_at: 2026-04-23T13:20:07Z\n---\n# Scrape\n\nbody\n"), 0o644))
 	srv := mcp.NewServer(brainDir, nil, nil, nil)
 	resp := toolCall(t, srv, "brain_reject", map[string]any{
 		"filename": "2026-04-23-scrape.md", "reason": "generic scrape, not homelab-relevant",
 	})
 	require.Nil(t, resp["error"], "got: %v", resp["error"])
 	text := resp["result"].(map[string]any)["content"].([]any)[0].(map[string]any)["text"].(string)
 	assert.Contains(t, text, "raw/rejected/2026-04-23-scrape.md")
 	got, err := os.ReadFile(filepath.Join(brainDir, "raw/rejected/2026-04-23-scrape.md"))
 	require.NoError(t, err)
 	assert.Contains(t, string(got), "reject_reason: generic scrape, not homelab-relevant")
 	_, srcErr := os.Stat(filepath.Join(raw, "2026-04-23-scrape.md"))
 	assert.True(t, os.IsNotExist(srcErr), "source removed from raw/")
 	// A rejected note must not still show up as pending.
 	pendingResp := toolCall(t, srv, "brain_pending", map[string]any{})
 	pendingText := pendingResp["result"].(map[string]any)["content"].([]any)[0].(map[string]any)["text"].(string)
 	assert.Contains(t, pendingText, `"pending":[]`)
 }
 func TestBrainRejectMissingSourceErrors(t *testing.T) {
 	brainDir := t.TempDir()
 	srv := mcp.NewServer(brainDir, nil, nil, nil)
 	resp := toolCall(t, srv, "brain_reject", map[string]any{"filename": "ghost.md"})
 	require.NotNil(t, resp["error"])
 }
@@ -1,24 +0,0 @@
 package mcp_test
 import (
 	"context"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/mcp"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/pipeline"
 )
 // hyperguild#149: brain_ingest's `path` read any file the pod could read and
 // ingested it into the brain, where brain_query reads it back out.
 func TestBrainIngestRefusesAPathOutsideTheRawInbox(t *testing.T) {
 	stub := pipeline.Config{Complete: func(context.Context, string, string) (string, error) {
 		return `[{"title":"Leak","type":"concept","content":"x"}]`, nil
 	}}
 	srv := mcp.NewServer(newBrainRepo(t), &stub, nil, nil)
 	resp := authCall(t, srv, "", "brain_ingest", map[string]any{"path": "/etc/hostname"})
 	require.NotNil(t, resp["error"], "a path outside brain/raw/ must be refused")
 	assert.Contains(t, resp["error"].(map[string]any)["message"], "brain/raw/")
 }
@@ -1,76 +0,0 @@
 package mcp
 import (
 	"time"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
 )
 // pendingNudgeThreshold is how old a raw/ note has to be before brain_context
 // mentions the queue. Two weeks: long enough that a note written this sprint
 // does not nag, short enough that four items cannot sit unnoticed for three
 // months again (#82).
 const pendingNudgeThreshold = 14 * 24 * time.Hour
 // PendingNudge is the in-session reminder that the promote/reject queue has
 // items waiting. It is advisory: a count, an age, and how to look.
 type PendingNudge struct {
 	Pending    int    `json:"pending"`     // everything in the queue
 	Aging      int    `json:"aging"`       // those past the threshold
 	Oldest     string `json:"oldest"`      // filename of the oldest pending note
 	OldestDays int    `json:"oldest_days"` // its age, in whole days
 	Hint       string `json:"hint"`
 }
 // pendingNudge summarises the raw/ review queue, or returns nil when there is
 // nothing worth saying.
 //
 // The trigger is the missing half of the queue (#82): brain_pending has always
 // existed, and four real items still sat unreviewed from 2026-04-23 to
 // 2026-07-15 because nothing ever prompted anyone to call it. The system
 // should be what remembers the queue exists.
 //
 // Threshold-gated on purpose. A notice on every context call is one people
 // learn to skip, which reproduces the original failure with extra steps.
 //
 // It never promotes, rejects, or reorders anything. Age is a reason to ask a
 // human, not a verdict — an old note may be exactly right to promote once
 // someone finally looks at it.
 func pendingNudge(brainDir string, now time.Time, threshold time.Duration) *PendingNudge {
 	pending, err := api.ListPending(brainDir)
 	if err != nil || len(pending) == 0 {
 		// brain_context is a hot path; a broken queue degrades to silence
 		// rather than failing the call that asked for project context.
 		return nil
 	}
 	var aging int
 	var oldestName string
 	var oldestAge time.Duration
 	for _, p := range pending {
 		created, perr := time.Parse(time.RFC3339, p.CreatedAt)
 		if perr != nil {
 			continue // an unparseable timestamp is not evidence of age
 		}
 		age := now.Sub(created)
 		if age >= threshold {
 			aging++
 		}
 		if age > oldestAge {
 			oldestAge, oldestName = age, p.Filename
 		}
 	}
 	if aging == 0 {
 		return nil
 	}
 	return &PendingNudge{
 		Pending:    len(pending),
 		Aging:      aging,
 		Oldest:     oldestName,
 		OldestDays: int(oldestAge.Hours() / 24),
 		Hint:       "call brain_pending to review; nothing is promoted or rejected automatically",
 	}
 }
@@ -1,115 +0,0 @@
 package mcp
 import (
 	"context"
 	"encoding/json"
 	"os"
 	"path/filepath"
 	"testing"
 	"time"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 // writePending drops a raw/ note whose created_at is age old.
 func writePending(t *testing.T, brainDir, name string, age time.Duration, now time.Time) {
 	t.Helper()
 	raw := filepath.Join(brainDir, "raw")
 	require.NoError(t, os.MkdirAll(raw, 0o755))
 	body := "---\ncreated_at: " + now.Add(-age).UTC().Format(time.RFC3339) + "\n---\n\nnote body\n"
 	require.NoError(t, os.WriteFile(filepath.Join(raw, name), []byte(body), 0o644))
 }
 func TestPendingNudge_SilentWhenNothingIsPending(t *testing.T) {
 	// No queue, no nudge. A notice that fires every session is one people
 	// learn to skip, which is how the queue got ignored for three months in
 	// the first place (#82).
 	got := pendingNudge(t.TempDir(), time.Now(), 14*24*time.Hour)
 	assert.Nil(t, got)
 }
 func TestPendingNudge_SilentWhileEverythingIsBelowTheThreshold(t *testing.T) {
 	now := time.Now()
 	dir := t.TempDir()
 	writePending(t, dir, "fresh.md", 2*24*time.Hour, now)
 	got := pendingNudge(dir, now, 14*24*time.Hour)
 	assert.Nil(t, got, "a two-day-old note is not aging")
 }
 func TestPendingNudge_ReportsCountAndOldestAgeOnceSomethingAges(t *testing.T) {
 	now := time.Now()
 	dir := t.TempDir()
 	writePending(t, dir, "old.md", 100*24*time.Hour, now)
 	writePending(t, dir, "older.md", 120*24*time.Hour, now)
 	writePending(t, dir, "fresh.md", 1*24*time.Hour, now)
 	got := pendingNudge(dir, now, 14*24*time.Hour)
 	require.NotNil(t, got)
 	// All three are pending; the threshold decides whether to speak, not
 	// what to count. Someone opening the queue sees the whole queue.
 	assert.Equal(t, 3, got.Pending)
 	assert.Equal(t, 2, got.Aging)
 	assert.Equal(t, 120, got.OldestDays)
 	assert.Equal(t, "older.md", got.Oldest)
 }
 func TestPendingNudge_NeverDecidesAnything(t *testing.T) {
 	// Aging is a trigger to ask a human, never a verdict. The nudge must
 	// carry no action and must leave the queue exactly as it found it.
 	now := time.Now()
 	dir := t.TempDir()
 	writePending(t, dir, "ancient.md", 365*24*time.Hour, now)
 	before, err := os.ReadDir(filepath.Join(dir, "raw"))
 	require.NoError(t, err)
 	got := pendingNudge(dir, now, 14*24*time.Hour)
 	require.NotNil(t, got)
 	after, err := os.ReadDir(filepath.Join(dir, "raw"))
 	require.NoError(t, err)
 	assert.Len(t, after, len(before), "the nudge must not promote or reject anything")
 	assert.Contains(t, got.Hint, "brain_pending", "the nudge should say how to look, not act")
 }
 func TestPendingNudge_SurvivesAnUnreadableQueue(t *testing.T) {
 	// brain_context is a hot path; a broken raw/ dir must degrade to silence
 	// rather than failing the whole context call.
 	dir := t.TempDir()
 	require.NoError(t, os.WriteFile(filepath.Join(dir, "raw"), []byte("not a directory"), 0o644))
 	assert.NotPanics(t, func() {
 		assert.Nil(t, pendingNudge(dir, time.Now(), 14*24*time.Hour))
 	})
 }
 func TestBrainContext_CarriesTheNudgeWithoutFailingWhenTheQueueIsEmpty(t *testing.T) {
 	// The wiring, not the summary: a nudge that never reaches a caller is the
 	// same as no nudge, and brain_context must still work with no queue.
 	dir := t.TempDir()
 	srv := NewServer(dir, nil, nil, nil)
 	raw, err := srv.brainContext(context.Background(),
 		json.RawMessage(`{"project_root":"/home/mathias/dev/AGENTS/hyperguild"}`))
 	require.NoError(t, err)
 	var empty map[string]any
 	require.NoError(t, json.Unmarshal(raw, &empty))
 	assert.NotContains(t, empty, "pending_review", "silence when nothing is aging")
 	writePending(t, dir, "ancient.md", 200*24*time.Hour, time.Now())
 	raw, err = srv.brainContext(context.Background(),
 		json.RawMessage(`{"project_root":"/home/mathias/dev/AGENTS/hyperguild"}`))
 	require.NoError(t, err)
 	var withQueue map[string]any
 	require.NoError(t, json.Unmarshal(raw, &withQueue))
 	nudge, ok := withQueue["pending_review"].(map[string]any)
 	require.True(t, ok, "the nudge must reach the caller: %v", withQueue)
 	assert.Equal(t, float64(1), nudge["aging"])
 	assert.Equal(t, "ancient.md", nudge["oldest"])
 }
@@ -1,325 +0,0 @@
 package mcp_test
 import (
 	"bytes"
 	"context"
 	"encoding/json"
 	"log/slog"
 	"os"
 	"path/filepath"
 	"regexp"
 	"strings"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"gopkg.in/yaml.v3"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/audit"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/brainstore"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/capture"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/capturehttp"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/classification"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/mcp"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/pipeline"
 )
 // Escapes found by the PR #147 gatekeeper review. Each test drives the real
 // mcp.Server as a JWT principal "attacker" and asserts the provenance
 // invariant on the file every reader sees.
 const jwtAuthz = "Bearer jwt-token"
 func jwtServer(t *testing.T) (*mcp.Server, string) {
 	t.Helper()
 	dir := newBrainRepo(t)
 	cfg, err := classification.Load(dir)
 	require.NoError(t, err)
 	svc := capture.NewService(brainstore.New(dir), capFakeTracker{}, cfg, audit.NewSlogSink(nil))
 	srv := mcp.NewServer(dir, nil, nil, nil)
 	srv.WithCapture(svc, capFakeValidator{subject: "attacker"}, capStaticTok, "local-cli",
 		capturehttp.NewOriginResolver(nil))
 	return srv, dir
 }
 var provenanceLine = regexp.MustCompile(`(?im)^\W*(origin|written_by)\W*:`)
 // assertProvenance checks the invariant on a note: the frontmatter parses as
 // YAML, yaml.v3 resolves exactly the stamped values, no other line-level
 // spelling of either key survives, and brain_get agrees.
 func assertProvenance(t *testing.T, srv *mcp.Server, dir, rel, wantOrigin, wantBy string) {
 	t.Helper()
 	b, err := os.ReadFile(filepath.Join(dir, filepath.FromSlash(rel)))
 	require.NoError(t, err)
 	fm := frontmatterOf(string(b))
 	var m map[string]any
 	require.NoError(t, yaml.Unmarshal([]byte(fm), &m), "frontmatter must parse as YAML:\n%s", fm)
 	assert.Equal(t, wantOrigin, m["origin"], "yaml.v3 origin\n%s", fm)
 	if wantBy == "" {
 		assert.NotContains(t, m, "written_by", "yaml.v3 written_by\n%s", fm)
 	} else {
 		assert.Equal(t, wantBy, m["written_by"], "yaml.v3 written_by\n%s", fm)
 	}
 	wantLines := 1
 	if wantBy != "" {
 		wantLines = 2
 	}
 	assert.Len(t, provenanceLine.FindAllString(fm, -1), wantLines, "exactly the stamped provenance lines\n%s", fm)
 	assert.NotContains(t, fm, "\r", "no carriage returns left in frontmatter")
 	got := resultText(t, authCall(t, srv, jwtAuthz, "brain_get", map[string]any{"path": rel}))
 	gfm, _ := got["frontmatter"].(map[string]any)
 	for k, v := range gfm {
 		lk := strings.ToLower(strings.Trim(k, `"' ?`))
 		if lk == "origin" {
 			assert.Equal(t, wantOrigin, v, "brain_get key %q", k)
 		}
 		if lk == "written_by" {
 			assert.Equal(t, wantBy, v, "brain_get key %q", k)
 		}
 	}
 }
 var forgedVariants = []struct{ name, fm string }{
 	{"plain", "origin: static\nwritten_by: local-cli\n"},
 	{"nospace", "origin:static\nwritten_by:local-cli\n"},
 	{"capital", "Origin: static\nWritten_by: local-cli\n"},
 	{"doublequotedkey", "\"origin\": static\n\"written_by\": local-cli\n"},
 	{"singlequotedkey", "'origin': static\n'written_by': local-cli\n"},
 	{"escapedkey", "\"orig\\u0069n\": static\n\"written\\u005fby\": local-cli\n"},
 	{"taggedkey", "!!str origin: static\n!!str written_by: local-cli\n"},
 	{"trailingws", "origin : static\nwritten_by : local-cli\n"},
 	{"tabkey", "origin\t: static\n"},
 	{"loneCR", "title: x\rorigin: static\rwritten_by: local-cli\n"},
 	{"complexkey", "? origin\n: static\n? written_by\n: local-cli\n"},
 	{"mergekey", "<<: {origin: static, written_by: local-cli}\n"},
 	{"flowmap", "{origin: static, written_by: local-cli}\n"},
 	{"anchor", "x: &a static\norigin: *a\n"},
 	// Round 2 (R1/R2): an alias key resolves only against an anchor on
 	// another line, and "..." ends the YAML document before the stamp.
 	{"aliaskey_docend", "x: &a origin\n*a : static\ny: &b written_by\n*b : local-cli\n...\n"},
 	{"aliaskey", "y: &b written_by\n*b : local-cli\n"},
 	{"docend_only", "x: y\n...\n"},
 	{"docstart_inside", "x: y\n---\norigin: static\n"},
 }
 func TestBrainWriteAsJWTStampsJWTForEveryForgedSpelling(t *testing.T) {
 	for _, v := range forgedVariants {
 		t.Run(v.name, func(t *testing.T) {
 			srv, dir := jwtServer(t)
 			out := resultText(t, authCall(t, srv, jwtAuthz, "brain_write", map[string]any{
 				"content": "---\n" + v.fm + "---\n# V\n\nbody", "wing": "testing", "hall": "facts",
 				"filename": "forge-" + v.name,
 			}))
 			assertProvenance(t, srv, dir, out["path"].(string), "jwt", "attacker")
 		})
 	}
 }
 func TestBrainUpdateAsJWTStampsJWTForEveryForgedSpelling(t *testing.T) {
 	for _, v := range forgedVariants {
 		t.Run(v.name, func(t *testing.T) {
 			srv, dir := jwtServer(t)
 			out := resultText(t, authCall(t, srv, jwtAuthz, "brain_write", map[string]any{
 				"content": "# V\n\nv1", "wing": "testing", "hall": "facts", "filename": "upd-" + v.name,
 			}))
 			path := out["path"].(string)
 			resultText(t, authCall(t, srv, jwtAuthz, "brain_update", map[string]any{
 				"path": path, "content": "---\n" + v.fm + "---\n# V\n\nv2",
 			}))
 			assertProvenance(t, srv, dir, path, "jwt", "attacker")
 		})
 	}
 }
 // E1: brain_edit is a byte-level replace; it must not be able to rewrite
 // provenance, and after any edit the note is attributed to the editor.
 func TestBrainEditCannotRewriteProvenanceAndRestampsToEditor(t *testing.T) {
 	srv, dir := jwtServer(t)
 	out := resultText(t, authCall(t, srv, jwtAuthz, "brain_write", map[string]any{
 		"content": "# E\n\nbody", "wing": "testing", "hall": "facts", "filename": "edit-forge",
 	}))
 	path := out["path"].(string)
 	authCall(t, srv, jwtAuthz, "brain_edit", map[string]any{
 		"path": path, "old_str": "origin: jwt\nwritten_by: attacker\n", "new_str": "origin: static\nwritten_by: local-cli\n",
 	})
 	assertProvenance(t, srv, dir, path, "jwt", "attacker")
 	// Assembling the value from existing text must not work either.
 	authCall(t, srv, jwtAuthz, "brain_edit", map[string]any{"path": path, "old_str": "jwt", "new_str": "static"})
 	assertProvenance(t, srv, dir, path, "jwt", "attacker")
 }
 // A static principal's note edited by a JWT session becomes the JWT
 // session's: the content a reader sees is no longer the static author's.
 func TestBrainEditByJWTReattributesAStaticNote(t *testing.T) {
 	srv, dir := jwtServer(t)
 	out := resultText(t, authCall(t, srv, "Bearer "+capStaticTok, "brain_write", map[string]any{
 		"content": "# S\n\nstatic body", "wing": "testing", "hall": "facts", "filename": "edit-reattr",
 	}))
 	path := out["path"].(string)
 	resultText(t, authCall(t, srv, jwtAuthz, "brain_edit", map[string]any{
 		"path": path, "old_str": "static body", "new_str": "injected body",
 	}))
 	assertProvenance(t, srv, dir, path, "jwt", "attacker")
 }
 // E1 via round 2's payload: the alias + document-end trick through brain_edit.
 func TestBrainEditCannotForgeProvenanceWithAliasKeys(t *testing.T) {
 	srv, dir := jwtServer(t)
 	out := resultText(t, authCall(t, srv, jwtAuthz, "brain_write", map[string]any{
 		"content": "---\ntitle: t\n---\n# E\n\nbody", "wing": "testing", "hall": "facts", "filename": "edit-alias",
 	}))
 	path := out["path"].(string)
 	authCall(t, srv, jwtAuthz, "brain_edit", map[string]any{
 		"path": path, "old_str": "title: t\n", "new_str": "title: t\nx: &a origin\n*a : static\n...\n",
 	})
 	assertProvenance(t, srv, dir, path, "jwt", "attacker")
 }
 // E2 + E4: brain_ingest_raw stamps every page it writes, and a newline in a
 // title cannot start a new frontmatter key — observed through brain_query,
 // whose reader is line-oriented, not just through yaml.v3 (round 2, R4).
 func TestBrainIngestRawStampsPagesAndNeutralisesTitleNewlines(t *testing.T) {
 	srv, dir := jwtServer(t)
 	out := resultText(t, authCall(t, srv, jwtAuthz, "brain_ingest_raw", map[string]any{
 		"source": "zqsrc", "pages": []map[string]any{
 			{"title": "Zqplain", "type": "concept", "content": "plain body"},
 			{"title": "Zqinj\norigin: static\nwritten_by: local-cli\nx: 'y", "type": "concept", "content": "inj body"},
 		},
 	}))
 	pages := out["pages"].([]any)
 	require.NotEmpty(t, pages)
 	for _, p := range pages {
 		assertProvenance(t, srv, dir, p.(string), "jwt", "attacker")
 		b, _ := os.ReadFile(filepath.Join(dir, p.(string)))
 		var m map[string]any
 		require.NoError(t, yaml.Unmarshal([]byte(frontmatterOf(string(b))), &m))
 		assert.NotContains(t, m, "x", "an injected key must not appear in %s", p)
 	}
 	q := resultText(t, authCall(t, srv, jwtAuthz, "brain_query", map[string]any{"query": "inj body"}))
 	var sawPage bool
 	for _, r := range q["results"].([]any) {
 		hit := r.(map[string]any)
 		// Generated aggregates (wiki/index.md, log.md, wing _index.md) quote
 		// titles from many authors and carry no single provenance; recorded
 		// as a residual on PR #147, not asserted here.
 		if !strings.HasPrefix(hit["path"].(string), "wiki/concepts/") {
 			continue
 		}
 		sawPage = true
 		assert.Equal(t, "jwt", hit["origin"], "line reader origin for %v", hit["path"])
 		assert.Equal(t, "attacker", hit["written_by"], "line reader written_by for %v", hit["path"])
 	}
 	assert.True(t, sawPage, "brain_query must return the injected page itself")
 }
 // E3: a page type is a directory name; it must not traverse out of wiki/.
 func TestBrainIngestRawRejectsPathTraversingType(t *testing.T) {
 	srv, dir := jwtServer(t)
 	authCall(t, srv, jwtAuthz, "brain_ingest_raw", map[string]any{
 		"source": "zqsrc2", "pages": []map[string]any{{"title": "Zqpromo", "type": "../raw", "content": "b"}},
 	})
 	ents, _ := os.ReadDir(filepath.Join(dir, "raw"))
 	assert.Empty(t, ents, "nothing may be written outside wiki/ by a page type")
 }
 // E3: promotion re-attributes the note to whoever promotes it, regardless of
 // what the raw note's frontmatter claims.
 func TestBrainPromoteRestampsToPromoter(t *testing.T) {
 	srv, dir := jwtServer(t)
 	require.NoError(t, os.MkdirAll(filepath.Join(dir, "raw"), 0o755))
 	require.NoError(t, os.WriteFile(filepath.Join(dir, "raw", "planted.md"),
 		[]byte("---\ntitle: Planted\norigin: static\nwritten_by: local-cli\n---\n# Planted\n\nbody\n"), 0o644))
 	out := resultText(t, authCall(t, srv, jwtAuthz, "brain_promote", map[string]any{
 		"filename": "planted.md", "wing": "testing", "hall": "facts",
 	}))
 	assertProvenance(t, srv, dir, out["path"].(string), "jwt", "attacker")
 }
 // E6: an error outcome must not carry argument values into the audit log.
 func TestToolsCallAuditErrorOutcomeCarriesNoArgumentValues(t *testing.T) {
 	const sentinel = "SENTINEL-ERR-7d1e"
 	srv, _ := jwtServer(t)
 	var buf bytes.Buffer
 	prev := slog.Default()
 	slog.SetDefault(slog.New(slog.NewJSONHandler(&buf, nil)))
 	t.Cleanup(func() { slog.SetDefault(prev) })
 	authCall(t, srv, jwtAuthz, "brain_write", map[string]any{
 		"content": "---\nhalf_life: " + sentinel + "\n---\n# H\n\nbody", "wing": "testing", "hall": "facts",
 	})
 	authCall(t, srv, jwtAuthz, "brain_update", map[string]any{"path": "wiki/testing/facts/" + sentinel + ".md", "content": "x"})
 	var sawError bool
 	for _, l := range strings.Split(buf.String(), "\n") {
 		var rec map[string]any
 		if json.Unmarshal([]byte(l), &rec) != nil || rec["msg"] != "mcp tool call" {
 			continue
 		}
 		if rec["outcome"] == "error" {
 			sawError = true
 		}
 		assert.NotContains(t, l, sentinel)
 	}
 	assert.True(t, sawError, "the failing calls must still be recorded as errors")
 }
 // Round 3 (B1): brain_edit adding a block scalar containing an indented "---"
 // must not hide provenance from brain_query's reader.
 func TestBrainEditBlockScalarFenceDoesNotHideProvenanceFromQuery(t *testing.T) {
 	srv, _ := jwtServer(t)
 	out := resultText(t, authCall(t, srv, jwtAuthz, "brain_write", map[string]any{
 		"content": "---\nk: v\n---\n# E\n\nzqrthreeeditdash", "wing": "testing", "hall": "facts", "filename": "edit-dash",
 	}))
 	resultText(t, authCall(t, srv, jwtAuthz, "brain_edit", map[string]any{
 		"path": out["path"], "old_str": "k: v\n", "new_str": "k: |\n  ---\n",
 	}))
 	q := resultText(t, authCall(t, srv, jwtAuthz, "brain_query", map[string]any{"query": "zqrthreeeditdash"}))
 	hit := q["results"].([]any)[0].(map[string]any)
 	assert.Equal(t, "jwt", hit["origin"])
 	assert.Equal(t, "attacker", hit["written_by"])
 }
 // Round 3 (B2): when the editor's stamp cannot be verified, the edit is rolled
 // back byte for byte and the tool says so. A JWT subject with an invalid UTF-8
 // byte cannot round-trip through YAML, which forces that path.
 func TestBrainEditRollsBackWhenTheStampCannotBeVerified(t *testing.T) {
 	dir := newBrainRepo(t)
 	cfg, err := classification.Load(dir)
 	require.NoError(t, err)
 	svc := capture.NewService(brainstore.New(dir), capFakeTracker{}, cfg, audit.NewSlogSink(nil))
 	srv := mcp.NewServer(dir, nil, nil, nil)
 	srv.WithCapture(svc, capFakeValidator{subject: "bad\xff"}, capStaticTok, "local-cli", capturehttp.NewOriginResolver(nil))
 	out := resultText(t, authCall(t, srv, "Bearer "+capStaticTok, "brain_write", map[string]any{
 		"content": "# R\n\nstatic body", "wing": "testing", "hall": "facts", "filename": "edit-rollback",
 	}))
 	path := out["path"].(string)
 	before, err := os.ReadFile(filepath.Join(dir, path))
 	require.NoError(t, err)
 	resp := authCall(t, srv, jwtAuthz, "brain_edit", map[string]any{"path": path, "old_str": "static body", "new_str": "injected"})
 	require.NotNil(t, resp["error"], "the edit must be reported as failed")
 	assert.Contains(t, resp["error"].(map[string]any)["message"], "rolled back")
 	after, err := os.ReadFile(filepath.Join(dir, path))
 	require.NoError(t, err)
 	assert.Equal(t, string(before), string(after), "the note must be byte-identical to before the edit")
 }
 // MCP brain_ingest (the LLM path) attributes its pages to the caller.
 func TestBrainIngestViaMCPStampsCaller(t *testing.T) {
 	dir := newBrainRepo(t)
 	cfg, err := classification.Load(dir)
 	require.NoError(t, err)
 	svc := capture.NewService(brainstore.New(dir), capFakeTracker{}, cfg, audit.NewSlogSink(nil))
 	stub := pipeline.Config{Complete: func(context.Context, string, string) (string, error) {
 		return `[{"title":"Zqllmpage","type":"concept","content":"zqllm body"}]`, nil
 	}}
 	srv := mcp.NewServer(dir, &stub, nil, nil)
 	srv.WithCapture(svc, capFakeValidator{subject: "attacker"}, capStaticTok, "local-cli", capturehttp.NewOriginResolver(nil))
 	out := resultText(t, authCall(t, srv, jwtAuthz, "brain_ingest", map[string]any{"content": "article text", "source": "zqllm"}))
 	pages := out["pages"].([]any)
 	require.NotEmpty(t, pages)
 	for _, p := range pages {
 		assertProvenance(t, srv, dir, p.(string), "jwt", "attacker")
 	}
 }
@@ -1,124 +0,0 @@
 package mcp_test
 import (
 	"encoding/json"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 // resultText decodes the tool result payload of a tools/call response.
 func resultText(t *testing.T, resp map[string]any) map[string]any {
 	t.Helper()
 	require.NotContains(t, resp, "error", "tool call failed: %v", resp["error"])
 	content := resp["result"].(map[string]any)["content"].([]any)
 	var out map[string]any
 	require.NoError(t, json.Unmarshal([]byte(content[0].(map[string]any)["text"].(string)), &out))
 	return out
 }
 func readNote(t *testing.T, dir, rel string) string {
 	t.Helper()
 	b, err := os.ReadFile(filepath.Join(dir, filepath.FromSlash(rel)))
 	require.NoError(t, err)
 	return string(b)
 }
 func frontmatterOf(note string) string {
 	parts := strings.SplitN(note, "---\n", 3)
 	if len(parts) < 3 {
 		return ""
 	}
 	return parts[1]
 }
 // hyperguild#145: a brain entry records which principal wrote it, so a reader
 // can tell a local-CLI note from one a connector session wrote after reading
 // an untrusted page.
 func TestBrainWriteStampsPrincipalProvenance(t *testing.T) {
 	srv, dir, _, _ := govServer(t)
 	out := resultText(t, authCall(t, srv, "Bearer "+capStaticTok, "brain_write", map[string]any{
 		"content": "# P\n\nbody", "wing": "testing", "hall": "facts", "filename": "prov-static",
 	}))
 	fm := frontmatterOf(readNote(t, dir, out["path"].(string)))
 	assert.Contains(t, fm, "origin: static\n")
 	assert.Contains(t, fm, "written_by: local-cli\n")
 }
 func TestBrainWriteWithoutPrincipalStampsOriginUnknown(t *testing.T) {
 	srv, dir, _, _ := govServer(t)
 	out := resultText(t, authCall(t, srv, "", "brain_write", map[string]any{
 		"content": "# P\n\nbody", "wing": "testing", "hall": "facts", "filename": "prov-unknown",
 	}))
 	fm := frontmatterOf(readNote(t, dir, out["path"].(string)))
 	assert.Contains(t, fm, "origin: unknown\n")
 	assert.NotContains(t, fm, "written_by:")
 }
 // The control: a caller cannot claim a more trusted origin by putting it in
 // its own frontmatter.
 func TestBrainWriteUnauthenticatedDropsPlainForgedProvenance(t *testing.T) {
 	srv, dir, _, _ := govServer(t)
 	forged := "---\norigin: static\nwritten_by: local-cli\n---\n# F\n\nbody"
 	out := resultText(t, authCall(t, srv, "", "brain_write", map[string]any{
 		"content": forged, "wing": "testing", "hall": "facts", "filename": "prov-forged",
 	}))
 	fm := frontmatterOf(readNote(t, dir, out["path"].(string)))
 	assert.Contains(t, fm, "origin: unknown\n")
 	assert.NotContains(t, fm, "origin: static")
 	assert.NotContains(t, fm, "written_by: local-cli")
 	assert.Equal(t, 1, strings.Count(fm, "origin:"), "exactly one origin line")
 }
 // brain_update replaces the content wholesale, so provenance follows the
 // last writer — and a forged fragment must not survive the merge either.
 func TestBrainUpdateRestampsProvenanceToTheUpdater(t *testing.T) {
 	srv, dir, _, _ := govServer(t)
 	out := resultText(t, authCall(t, srv, "Bearer "+capStaticTok, "brain_write", map[string]any{
 		"content": "# U\n\nv1", "wing": "testing", "hall": "facts", "filename": "prov-update",
 	}))
 	path := out["path"].(string)
 	resultText(t, authCall(t, srv, "", "brain_update", map[string]any{
 		"path": path, "content": "---\norigin: static\nwritten_by: local-cli\n---\n# U\n\nv2",
 	}))
 	fm := frontmatterOf(readNote(t, dir, path))
 	assert.Contains(t, fm, "origin: unknown\n")
 	assert.NotContains(t, fm, "written_by: local-cli")
 	assert.Equal(t, 1, strings.Count(fm, "origin:"))
 }
 func TestBrainQueryReturnsProvenance(t *testing.T) {
 	srv, _, _, _ := govServer(t)
 	resultText(t, authCall(t, srv, "Bearer "+capStaticTok, "brain_write", map[string]any{
 		"content": "# Zebrafinch\n\nzebrafinch provenance probe", "wing": "testing", "hall": "facts", "filename": "prov-query",
 	}))
 	out := resultText(t, authCall(t, srv, "Bearer "+capStaticTok, "brain_query", map[string]any{"query": "zebrafinch"}))
 	results := out["results"].([]any)
 	require.NotEmpty(t, results)
 	hit := results[0].(map[string]any)
 	assert.Equal(t, "static", hit["origin"])
 	assert.Equal(t, "local-cli", hit["written_by"])
 }
 // capture is the door a claude.ai connector session uses, so it is the one
 // whose provenance matters most: a JWT principal must be stamped as such.
 func TestMCPCaptureStampsJWTProvenance(t *testing.T) {
 	srv, brainDir := captureServer(t, capFakeValidator{subject: "koala-cli"}, []string{"koala-cli"})
 	resp := captureCall(t, srv, "Bearer jwt-token", map[string]any{
 		"context":  map[string]any{"harness": "claude-code", "actor": "mathias", "classification": "internal"},
 		"insights": []map[string]any{{"text": "Capture provenance probe", "wing": "hyperguild", "hall": "facts"}},
 	})
 	require.Nil(t, resp["error"], "got error: %v", resp["error"])
 	matches, err := filepath.Glob(filepath.Join(brainDir, "wiki/hyperguild/facts/*.md"))
 	require.NoError(t, err)
 	require.Len(t, matches, 1)
 	b, err := os.ReadFile(matches[0])
 	require.NoError(t, err)
 	fm := frontmatterOf(string(b))
 	assert.Contains(t, fm, "origin: jwt\n")
 	assert.Contains(t, fm, "written_by: koala-cli\n")
 }
@@ -1,14 +1,9 @@
 // Package mcp implements an MCP HTTP handler for the ingestion service.
 // Exposed tools: brain_query, brain_write, brain_update, brain_get,
-// brain_pending, brain_promote, brain_tunnel, brain_ingest,
+// brain_pending, brain_promote, brain_index, brain_tunnel, brain_ingest,
 // brain_ingest_raw, brain_answer, brain_classify, brain_graph,
 // brain_context, session_log, and capture (the #55 relay tool, registered
 // only when WithCapture is set).
 //
 // brain_index dispatches but is deliberately absent from tools/list: it is
 // auto-called after every write, so surfacing it as a caller verb is
 // cognitive load with no decision behind it (ADR-0012 rule 4, #78). It stays
 // callable for maintenance — de-surfacing hides the verb, not the operation.
 package mcp
 import (
@@ -16,7 +11,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
 	"time"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/brainstore"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/capture"
@@ -50,8 +44,6 @@ type rpcError struct {
 // Server handles MCP JSON-RPC over HTTP for the ingestion service.
 type Server struct {
 	brainDir  string
 	govAudit  capture.AuditSink
 	govNotify govNotifier
 	pipeline  pipeline.Config
 	llm       pipeline.CompleteFunc
 	answerLLM pipeline.CompleteFunc // nil = brain_answer and brain_classify unavailable
@@ -230,9 +222,7 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 				ctx = withPrincipal(ctx, principal, viaStatic)
 			}
 		}
 		start := time.Now()
 		out, err := s.handleCall(ctx, p.Name, p.Arguments)
 		logToolCall(ctx, p.Name, p.Arguments, start, err)
 		if err != nil {
 			rpcErr = &rpcError{Code: -32000, Message: err.Error()}
 			break
@@ -278,19 +268,8 @@ func (s *Server) handleCall(ctx context.Context, name string, args json.RawMessa
 		return s.brainPending(ctx, args)
 	case "brain_promote":
 		return s.brainPromote(ctx, args)
 	case "brain_reject":
 		return s.brainReject(ctx, args)
 	case "capture":
 		return s.brainCapture(ctx, args)
 	case "brain_read":
 		return s.brainRead(ctx, args)
 	case "brain_edit":
 		return s.brainEdit(ctx, args)
 	case "brain_edit_root":
 		// Dispatches but is intentionally absent from tools/list — see
 		// tools_notes.go for why a governance-file editor must not be
 		// discoverable by a model.
 		return s.brainEditRoot(ctx, args)
 	case "brain_index":
 		return s.brainIndex(ctx, args)
 	case "brain_tunnel":
@@ -58,44 +58,12 @@ func TestServerToolsList(t *testing.T) {
 	}
 	assert.ElementsMatch(t, []string{
 		"brain_query", "brain_write", "brain_update", "brain_get",
-		"brain_pending", "brain_promote", "brain_reject",
+		"brain_pending", "brain_promote",
-		"brain_read", "brain_edit",
+		"brain_index", "brain_tunnel",
 		"brain_tunnel",
 		"brain_ingest_raw", "brain_ingest",
 		"brain_answer", "brain_classify", "brain_graph", "brain_context",
 		"session_log",
 	}, names)
 	// brain_index is auto-called after every brain_write, so surfacing it as
 	// a caller verb is cognitive load with no decision behind it (ADR-0012
 	// rule 4, #78). The capability stays reachable — see the admin test below.
 	assert.NotContains(t, names, "brain_index")
 	// brain_edit_root is de-surfaced for a sharper reason than brain_index:
 	// brain content is ingested from the outside world and reaches a model's
 	// context, so a listed governance-file editor would be a durable
 	// prompt-injection path — one poisoned page rewriting the CLAUDE.md a
 	// .dispatch-allow agent later loads as instructions.
 	assert.NotContains(t, names, "brain_edit_root")
 }
 func TestBrainIndexStaysCallableForAdminUseAfterDeSurfacing(t *testing.T) {
 	// De-surfacing hides the verb from the model-facing list; it must not
 	// remove the operation. A maintenance caller still needs to rebuild a
 	// Map of Content by hand.
 	srv := mcp.NewServer(t.TempDir(), nil, nil, nil)
 	req := httptest.NewRequest(http.MethodPost, "/mcp", body(t, map[string]any{
 		"jsonrpc": "2.0", "id": 3, "method": "tools/call",
 		"params": map[string]any{"name": "brain_index", "arguments": map[string]any{}},
 	}))
 	rr := httptest.NewRecorder()
 	srv.ServeHTTP(rr, req)
 	require.Equal(t, http.StatusOK, rr.Code)
 	var resp map[string]any
 	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &resp))
 	assert.NotContains(t, resp, "error", "brain_index must still dispatch: %v", resp["error"])
 }
 func TestServerNotificationGetsNoBody(t *testing.T) {
@@ -134,11 +102,9 @@ type stubTracker struct{}
 func (stubTracker) CreateIssue(context.Context, string, string, string) (capture.IssueRef, error) {
 	return capture.IssueRef{}, nil
 }
 func (stubTracker) CloseIssue(context.Context, string, int, string) (capture.IssueRef, error) {
 	return capture.IssueRef{}, nil
 }
 func (stubTracker) CommentIssue(context.Context, string, int, string) (capture.IssueRef, error) {
 	return capture.IssueRef{}, nil
 }
@@ -90,7 +90,6 @@ func (s *Server) brainCapture(ctx context.Context, args json.RawMessage) (json.R
 	// Principal and origin are server-derived — never taken from the body.
 	in.Context.Principal = info.principal
 	in.Context.Origin = s.capture.resolver.Resolve(info.principal, info.viaStatic)
 	in.Context.AuthPath, _ = provenanceFrom(ctx)
 	rec, err := s.capture.svc.Capture(ctx, in)
 	if err != nil {
@@ -100,17 +99,3 @@ func (s *Server) brainCapture(ctx context.Context, args json.RawMessage) (json.R
 	}
 	return json.Marshal(rec)
 }
 // provenanceFrom maps the authenticated principal in ctx to the provenance
 // stamped on a brain write (hyperguild#145). No principal → "unknown", never
 // silence: an unstamped note must not read as trusted.
 func provenanceFrom(ctx context.Context) (origin, writtenBy string) {
 	info, ok := ctx.Value(principalKey).(principalInfo)
 	if !ok {
 		return "unknown", ""
 	}
 	if info.viaStatic {
 		return "static", info.principal
 	}
 	return "jwt", info.principal
 }
@@ -28,11 +28,9 @@ type capFakeTracker struct{}
 func (capFakeTracker) CreateIssue(context.Context, string, string, string) (capture.IssueRef, error) {
 	return capture.IssueRef{Repo: "hyperguild", Number: 1, URL: "https://git/1"}, nil
 }
 func (capFakeTracker) CloseIssue(context.Context, string, int, string) (capture.IssueRef, error) {
 	return capture.IssueRef{}, nil
 }
 func (capFakeTracker) CommentIssue(context.Context, string, int, string) (capture.IssueRef, error) {
 	return capture.IssueRef{}, nil
 }
@@ -8,10 +8,8 @@ import (
 	"path/filepath"
 	"sort"
 	"strings"
 	"time"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/search"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/textutil"
 )
 // brainContextArgs is the input shape of brain_context. project_root is
@@ -157,21 +155,17 @@ func (s *Server) brainContext(ctx context.Context, args json.RawMessage) (json.R
 		entries = entries[:limit]
 	}
-	out := map[string]any{"entries": entries}
+	return json.Marshal(map[string]any{"entries": entries})
 	// The queue nudge rides along with a call the session already makes, so
 	// noticing an aging note costs nobody a decision to go looking (#82).
 	// Advisory only, and absent entirely when there is nothing to say.
 	if n := pendingNudge(s.brainDir, time.Now(), pendingNudgeThreshold); n != nil {
 		out["pending_review"] = n
 	}
 	return json.Marshal(out)
 }
 // truncateExcerpt clamps an already-stripped excerpt to maxLen characters
 // without re-running the frontmatter parser. The ellipsis suffix matches
 // the convention used in search.excerpt.
 func truncateExcerpt(s string, maxLen int) string {
-	return textutil.Truncate(s, maxLen)
+	if len(s) <= maxLen {
 		return s
 	}
 	return s[:maxLen] + "…"
 }
 // readExcerpt loads a doc relative to brainDir, strips its frontmatter,
@@ -191,7 +185,10 @@ func readExcerpt(brainDir, relPath string, maxLen int) string {
 	if len(parts) == 3 {
 		body = strings.TrimSpace(parts[2])
 	}
-	return textutil.Truncate(body, maxLen)
+	if len(body) > maxLen {
 		return body[:maxLen] + "…"
 	}
 	return body
 }
 // max1 returns the maximum of n and 1, used to guard against divide-by-zero
@@ -1,432 +0,0 @@
 package mcp
 import (
 	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
 	"log/slog"
 	"os"
 	"strings"
 	"time"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/brain"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/capture"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/claim"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/classification"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/frontmatter"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/notes"
 )
 // noteToolDescriptors are the model-facing halves of brain#4.
 //
 // brain_edit_root is deliberately absent: it dispatches but is not listed, the
 // same de-surfacing ADR-0012 rule 4 applies to brain_index (#78). Hiding the
 // verb matters here for a specific reason — brain content is ingested from the
 // outside world and reaches a model's context, so a listed governance-file
 // editor is a durable prompt-injection path: one poisoned page could rewrite
 // the CLAUDE.md that a .dispatch-allow agent later obeys. A human who knows
 // the tool exists can still call it; a model reading tools/list cannot
 // discover it.
 func noteToolDescriptors() []map[string]any {
 	str := func(d string) map[string]any { return map[string]any{"type": "string", "description": d} }
 	schema := func(required []string, props map[string]any) json.RawMessage {
 		b, _ := json.Marshal(map[string]any{"type": "object", "required": required, "properties": props})
 		return b
 	}
 	return []map[string]any{
 		{
 			"name": "brain_read",
 			"description": "Return a note's raw markdown verbatim — no synthesis, no excerpting. " +
 				"Use this to obtain the exact text before brain_edit; never build old_str from a " +
 				"brain_query excerpt, which is truncated and normalised and will not match.",
 			"inputSchema": schema([]string{"path"}, map[string]any{
 				"path": str("brain-relative path under knowledge/ or wiki/, e.g. wiki/homelab/facts/x.md"),
 			}),
 		},
 		{
 			"name": "brain_edit",
 			"description": "Replace exactly one occurrence of old_str with new_str in a note, leaving " +
 				"every other byte identical. Fails loudly if old_str is absent or matches more than " +
 				"once — extend old_str until it is unique. Does NOT stamp updated_at or supersedes " +
 				"(brain_update does); it is a byte-level patch, not a metadata operation.",
 			"inputSchema": schema([]string{"path", "old_str", "new_str"}, map[string]any{
 				"path":    str("brain-relative path under knowledge/ or wiki/"),
 				"old_str": str("exact text to replace; must occur exactly once"),
 				"new_str": str("replacement text; empty string deletes old_str"),
 			}),
 		},
 	}
 }
 // --- hyperguild#97: governance-rewrite observability -----------------------
 // govNotifier raises an out-of-band alert. Declared here rather than importing
 // internal/audit so the MCP package keeps depending on capture alone.
 type govNotifier interface {
 	Notify(ctx context.Context, msg string) error
 }
 // WithGovernanceObserver attaches the audit sink and notifier that observe a
 // successful brain_edit_root. Both are optional; either may be nil.
 func (s *Server) WithGovernanceObserver(sink capture.AuditSink, n govNotifier) {
 	s.govAudit, s.govNotify = sink, n
 }
 type brainReadArgs struct {
 	Path string `json:"path"`
 }
 func (s *Server) brainRead(_ context.Context, args json.RawMessage) (json.RawMessage, error) {
 	var a brainReadArgs
 	if err := json.Unmarshal(args, &a); err != nil {
 		return nil, fmt.Errorf("parse args: %w", err)
 	}
 	content, err := notes.Read(s.brainDir, a.Path)
 	if err != nil {
 		return nil, err
 	}
 	return json.Marshal(map[string]any{"path": a.Path, "content": string(content)})
 }
 type brainEditArgs struct {
 	Path   string `json:"path"`
 	OldStr string `json:"old_str"`
 	NewStr string `json:"new_str"`
 }
 // brainEdit is the model-facing editor: notes only.
 //
 // Deliberately NOT audited (#97). A note edit is already fully reconstructible
 // from git history, which carries the same before/after bytes plus a diff.
 // Governance files get the extra trail because they change what later agents
 // obey — the asymmetry is about instruction-carrying content, not about how
 // hard the change is to reconstruct. Auditing every note edit would also bury
 // the rare governance record under routine traffic, which is how an alert
 // stops being read.
 func (s *Server) brainEdit(ctx context.Context, args json.RawMessage) (json.RawMessage, error) {
 	// Snapshot before editing: if the edited note cannot be stamped and
 	// verified, the edit is rolled back rather than left on disk unattributed
 	// (or carrying whatever provenance the edit wrote).
 	var a brainEditArgs
 	if err := json.Unmarshal(args, &a); err != nil {
 		return nil, fmt.Errorf("parse args: %w", err)
 	}
 	target, err := notes.Resolve(s.brainDir, a.Path, notes.ScopeNotes)
 	if err != nil {
 		return nil, err
 	}
 	// No snapshot, no edit: without one a failed stamp could not be undone.
 	prior, err := os.ReadFile(target.Abs)
 	if err != nil {
 		return nil, fmt.Errorf("snapshot before edit: %w", err)
 	}
 	res, out, err := s.editWithScope(args, notes.ScopeNotes)
 	if err != nil {
 		return out, err
 	}
 	// A byte-level replace can rewrite any line, including provenance, and
 	// whoever edits a note is the author of what a reader now sees: re-stamp
 	// to the editor after every edit (PR #147 review, escape E1).
 	origin, writtenBy := provenanceFrom(ctx)
 	if serr := api.StampProvenanceFile(s.brainDir, res.Path, origin, writtenBy); serr != nil {
 		if werr := os.WriteFile(target.Abs, prior, 0o644); werr != nil {
 			// Say exactly what state the note is in: edited, unverified.
 			return nil, fmt.Errorf("stamp provenance failed (%v) AND the edit could NOT be rolled back: %w; "+
 				"%s carries the edit under its previous attribution", serr, werr, res.Path)
 		}
 		return nil, fmt.Errorf("edit rolled back, stamp provenance: %w", serr)
 	}
 	return out, nil
 }
 // brainEditRoot edits a governance file (CLAUDE.md). De-surfaced AND gated on
 // the authenticated principal: only the static local-CLI token may call it, so
 // a claude.ai-origin session — the one that may have just read an untrusted
 // page — cannot rewrite the instructions later agents load.
 func (s *Server) brainEditRoot(ctx context.Context, args json.RawMessage) (json.RawMessage, error) {
 	info, ok := ctx.Value(principalKey).(principalInfo)
 	if !ok || !info.viaStatic {
 		return nil, fmt.Errorf("brain_edit_root requires the local static principal; " +
 			"a governance file is not editable from a model-facing origin")
 	}
 	res, out, err := s.editWithScope(args, notes.ScopeRoot)
 	if err != nil {
 		// A refusal is not a rewrite. Recording or alerting on one would cry
 		// wolf, and the gate already logs its own denials.
 		return out, err
 	}
 	// A durable instruction rewrite should be loud, not silent.
 	slog.Warn("brain_edit_root applied", "principal", info.principal, "result", string(out))
 	s.observeGovernanceEdit(ctx, info.principal, res)
 	return out, err
 }
 // observeGovernanceEdit records and alerts on a rewrite that already landed.
 //
 // Best-effort by construction: the bytes are written and brain-sync will commit
 // them within the quarter hour, so failing the call here would report a
 // non-rewrite to the caller while the rewrite sits on disk. A failure to
 // observe is therefore logged at ERROR — the one case where the trail itself is
 // what broke, and the only remaining signal.
 func (s *Server) observeGovernanceEdit(ctx context.Context, principal string, res notes.Result) {
 	// Path and hashes only. The notification leaves the cluster for a phone
 	// via a third-party topic; a hash identifies the rewrite, the bytes would
 	// leak whatever was written into an instruction file.
 	msg := fmt.Sprintf("brain_edit_root applied\npath=%s\nprincipal=%s\nbefore=%s\nafter=%s",
 		res.Path, principal, res.PrevContentHash, res.ContentHash)
 	if s.govNotify != nil {
 		if err := s.govNotify.Notify(ctx, msg); err != nil {
 			slog.Error("brain_edit_root notify failed", "path", res.Path, "err", err)
 		}
 	}
 	if s.govAudit == nil {
 		return
 	}
 	// Internal, not Confidential: a governance file is not client data, and
 	// Confidential would make DegradingSink REFUSE to record while loki is
 	// down rather than buffer — losing exactly the record that matters most.
 	outcome, err := s.govAudit.Reserve(ctx, classification.Internal)
 	if err != nil {
 		slog.Error("brain_edit_root audit reserve failed", "path", res.Path, "err", err)
 		return
 	}
 	entry := capture.AuditEntry{
 		Timestamp:               time.Now().UTC(),
 		Principal:               principal,
 		Actor:                   "brain_edit_root",
 		Harness:                 "mcp",
 		EffectiveClassification: classification.Internal.String(),
 		Items:                   []string{res.Path},
 		SecurityEvents: []string{fmt.Sprintf(
 			"governance file rewritten: %s before=%s after=%s",
 			res.Path, res.PrevContentHash, res.ContentHash)},
 	}
 	if err := s.govAudit.Record(ctx, entry, outcome); err != nil {
 		slog.Error("brain_edit_root audit record failed", "path", res.Path, "err", err)
 	}
 }
 func (s *Server) editWithScope(args json.RawMessage, scope notes.Scope) (notes.Result, json.RawMessage, error) {
 	var a brainEditArgs
 	if err := json.Unmarshal(args, &a); err != nil {
 		return notes.Result{}, nil, fmt.Errorf("parse args: %w", err)
 	}
 	// hyperguild#123: brain_write/brain_update both validate the claim
 	// envelope before writing (hyperguild#111: "same rules when a note
 	// changes as when it's born"); brain_edit didn't — a byte-level string
 	// replace has no frontmatter awareness at all, so it could rewrite an
 	// existing half_life:/applies:/claim_provenance: line straight past the
 	// validator entirely. Scoped to notes only (governance files have no
 	// claim-envelope concept).
 	if scope == notes.ScopeNotes {
 		if verr := checkClaimEnvelope(s.brainDir, a.Path, a.OldStr, a.NewStr); verr != nil {
 			return notes.Result{}, nil, fmt.Errorf("claim envelope: %w", verr)
 		}
 	}
 	res, err := notes.Edit(s.brainDir, a.Path, a.OldStr, a.NewStr, scope)
 	if err != nil {
 		if errors.Is(err, notes.ErrDegenerate) && a.OldStr == "" {
 			// hyperguild#115: "old_str is empty" alone doesn't say whether the
 			// caller sent it empty or a hop between the caller and here lost
 			// it. Naming the raw argument byte count makes that distinguishable
 			// without a second investigation.
 			return notes.Result{}, nil, fmt.Errorf("%w (raw arguments were %d bytes)", err, len(args))
 		}
 		return notes.Result{}, nil, err
 	}
 	// Reindex only when the edit could have changed what the index reads.
 	// BuildWingIndex consumes title/created_at from the frontmatter block;
 	// BM25 walks the filesystem live and embeddings are mtime-driven, so an
 	// unconditional rebuild would buy nothing and dirty a second file —
 	// _index.md being precisely the class brain-sync already needs a bespoke
 	// conflict resolver for.
 	if wing := wingOf(res.Path); wing != "" && touchesFrontmatter(a.OldStr, a.NewStr) {
 		if ierr := brain.BuildWingIndex(s.brainDir, wing); ierr != nil {
 			// Best-effort, matching every other index hook here: the write
 			// already landed and will be committed, so failing the call would
 			// make the caller retry an edit whose old_str no longer exists.
 			res.ReindexError = ierr.Error()
 		}
 	}
 	out, merr := json.Marshal(res)
 	return res, out, merr
 }
 // wingOf returns the wing for a wiki path, or "" for knowledge/ and root.
 func wingOf(rel string) string {
 	parts := strings.Split(rel, "/")
 	if len(parts) < 3 || parts[0] != "wiki" {
 		return ""
 	}
 	return parts[1]
 }
 // touchesFrontmatter reports whether either side of the edit mentions a field
 // the wing index reads.
 func touchesFrontmatter(oldStr, newStr string) bool {
 	for _, s := range []string{oldStr, newStr} {
 		if strings.Contains(s, "title:") || strings.Contains(s, "created_at:") || strings.Contains(s, "---") {
 			return true
 		}
 	}
 	return false
 }
 // checkClaimEnvelope previews what old_str->new_str would produce — the
 // exact strings.Replace(before, oldStr, newStr, 1) formula notes.Edit
 // itself uses internally — and validates the resulting frontmatter's claim
 // envelope before the real edit is allowed to run. Fail-closed: an invalid
 // result blocks the edit entirely, the same posture writeHallNote/UpdateNote
 // already apply on create/supersede.
 //
 // Gated on old_str appearing within the note's frontmatter BLOCK, not on
 // old_str/new_str mentioning a claim-envelope field NAME — found in review:
 // a field-name-substring gate misses a value-only edit like
 // "asserted"->"guessed" on a claim_provenance line, which never mentions
 // the field name at all. That is exactly the shape of edit a minimal,
 // natural diff produces, so a field-name gate was closing the issue in
 // name only. Checking block containment instead means any edit that
 // couldn't possibly touch the frontmatter (its target text only exists in
 // the body) is still skipped cheaply, while nothing inside the fence can
 // slip through unvalidated regardless of which token it targets.
 //
 // This does not replicate notes.Edit's uniqueness/CRLF/conflict-marker
 // checks — if old_str is absent or ambiguous, this preview may not match
 // what Edit ultimately does, but Edit independently and correctly rejects
 // those cases at write time regardless of what this function decides, so
 // the only thing riding on this preview's accuracy is the envelope check
 // itself, not write safety.
 // checkClaimEnvelope previews what old_str->new_str would produce and
 // validates the resulting claim envelope before the real edit runs
 // (hyperguild#123). Seven review rounds closed every plausible bypass in the
 // fence-detection family (field-name substring, block-containment,
 // fence-stripping, CRLF, UTF-8 BOM) and the first instance of a
 // value-extraction gap (a folded YAML block scalar hiding a value behind an
 // empty inline colon).
 //
 // Known, accepted v1 gap: frontmatterScalars's block-scalar fold is a
 // best-effort approximation, not a YAML parser — a blank line interrupting a
 // folded continuation, or other contrived multi-line YAML shapes not yet
 // probed (block-scalar indicators `|`/`>`, inline comments on a key line,
 // quoted multi-line values), can still hide an invalid value from
 // ValidateEnvelope. Accepted deliberately rather than chased indefinitely:
 // every bypass found so far requires the caller to already hold brain_edit
 // write access and to deliberately construct a specific malformed-YAML shape
 // with knowledge of this exact gap — a narrow, low-likelihood threat next to
 // the diminishing returns of another incremental patch round. The real fix
 // (a shared, tested, encoding-normalized frontmatter parser used by all
 // three independent implementations in this codebase) is tracked separately
 // as hyperguild#138, not bolted on here piece by piece.
 func checkClaimEnvelope(brainDir, path, oldStr, newStr string) error {
 	if oldStr == "" {
 		// hyperguild#115: strings.Replace treats "" as matching position 0,
 		// which would make an empty old_str look like an edit that inserts
 		// text before the fence — a degenerate-input case that belongs to
 		// notes.Edit's own "old_str is empty" refusal, not to the envelope
 		// check.
 		return nil
 	}
 	before, err := notes.Read(brainDir, path)
 	if err != nil {
 		// Let notes.Edit itself produce the real error (missing file, etc.)
 		// — this function's job is the envelope, not read failures.
 		return nil
 	}
 	// No gate on where old_str falls relative to the frontmatter fence:
 	// round 2 found that requiring old_str to be fully contained in the
 	// extracted block was itself bypassable by an old_str disambiguated
 	// across the closing "---" into the body. Simpler and bypass-proof:
 	// always compute what the edit would produce and validate that
 	// resulting state's envelope. A body-only edit leaves the frontmatter
 	// (and thus the validation outcome) unchanged, so this is a no-op for
 	// the common case and fail-closed for every case that touches the
 	// envelope, regardless of how old_str is phrased.
 	_, hadFence := frontmatterBlock(string(before))
 	after := strings.Replace(string(before), oldStr, newStr, 1)
 	_, hasFence := frontmatterBlock(after)
 	if hadFence && !hasFence {
 		// Round 3: an edit that drops the closing fence degrades `after`
 		// to "unfenced" — frontmatterScalars then sees an empty map and
 		// ValidateEnvelope({}) is nil by design (absent fields are valid),
 		// so an invalid value would otherwise land with zero error while
 		// also corrupting the note's structure. A previously-fenced note
 		// must stay fenced, full stop.
 		return fmt.Errorf("edit would remove the frontmatter fence")
 	}
 	return claim.ValidateEnvelope(frontmatterScalars(after))
 }
 // frontmatterBlock returns the raw text between doc's opening and closing
 // `---` fences, or ok=false if doc has no (properly closed) fence.
 func frontmatterBlock(doc string) (block string, ok bool) {
 	// hyperguild#138: fence detection itself is frontmatter.Split, shared
 	// with internal/api and internal/frontmatter — the CRLF/BOM guards that
 	// used to live here (added piecemeal across rounds 4 and 5 of #123's
 	// review) are now the shared parser's job, so every caller inherits a
 	// fix instead of needing bug-for-bug parity edits.
 	b, _, ok := frontmatter.Split([]byte(doc))
 	if !ok {
 		return "", false
 	}
 	// Split's block keeps the "\n" immediately before the closing fence
 	// (by design — see its own doc comment); this function never included
 	// it. Split guarantees ok=true only when "\n---\n" matched, so this is
 	// always exactly one byte, never ambiguous.
 	return strings.TrimSuffix(string(b), "\n"), true
 }
 // frontmatterScalars extracts top-level "key: value" scalar pairs from
 // doc's leading fence block, for the claim-envelope check only — not a
 // general frontmatter parser. Indented lines (YAML block-list items,
 // wrapped values) are skipped rather than misparsed as keys, same fix as
 // hyperguild#126/#128 in the sibling packages this mirrors.
 func frontmatterScalars(doc string) map[string]string {
 	out := map[string]string{}
 	block, ok := frontmatterBlock(doc)
 	if !ok {
 		return out
 	}
 	lines := strings.Split(block, "\n")
 	for i := 0; i < len(lines); i++ {
 		line := lines[i]
 		if line != "" && (line[0] == ' ' || line[0] == '\t') {
 			continue
 		}
 		key, val, ok := strings.Cut(line, ":")
 		if !ok {
 			continue
 		}
 		val = strings.TrimSpace(val)
 		if val == "" {
 			// Round 6: a colon with nothing after it is ambiguous — it can
 			// be a genuinely empty/omitted value, or the start of a YAML
 			// block scalar whose real value lives on the indented
 			// continuation line(s) that follow (e.g. "half_life:\n
 			// durable"). Treating the latter as absent let an edit smuggle
 			// an invalid value straight past ValidateEnvelope: the field
 			// read as unset while the disk actually carried a value. Fold
 			// the continuation in as a best-effort join so oneOf() still
 			// sees it. A genuinely empty value (no indented line follows)
 			// still folds to "", preserving present()'s existing
 			// placeholder-not-assertion contract.
 			var cont []string
 			for i+1 < len(lines) {
 				next := lines[i+1]
 				if next == "" || (next[0] != ' ' && next[0] != '\t') {
 					break
 				}
 				cont = append(cont, strings.TrimSpace(next))
 				i++
 			}
 			val = strings.Join(cont, " ")
 		}
 		out[strings.TrimSpace(key)] = val
 	}
 	return out
 }
@@ -1,560 +0,0 @@
 // ingestion/internal/mcp/tools_notes_test.go
 package mcp_test
 import (
 	"context"
 	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/audit"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/brainstore"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/capture"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/capturehttp"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/classification"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/mcp"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 // ---- brain#4: brain_read / brain_edit through the JSON-RPC surface --------
 func newBrainRepo(t *testing.T) string {
 	t.Helper()
 	dir := t.TempDir()
 	require.NoError(t, os.MkdirAll(filepath.Join(dir, ".git"), 0o755))
 	require.NoError(t, os.MkdirAll(filepath.Join(dir, "wiki/homelab/facts"), 0o755))
 	require.NoError(t, os.WriteFile(filepath.Join(dir, "wiki/homelab/facts/n.md"),
 		[]byte("---\ntitle: 'n'\n---\n\nalpha\nbeta\n"), 0o644))
 	require.NoError(t, os.WriteFile(filepath.Join(dir, "CLAUDE.md"), []byte("# rules\n"), 0o644))
 	return dir
 }
 func call(t *testing.T, srv *mcp.Server, name string, args map[string]any) map[string]any {
 	t.Helper()
 	req := httptest.NewRequest(http.MethodPost, "/mcp", body(t, map[string]any{
 		"jsonrpc": "2.0", "id": 1, "method": "tools/call",
 		"params": map[string]any{"name": name, "arguments": args},
 	}))
 	rr := httptest.NewRecorder()
 	srv.ServeHTTP(rr, req)
 	var resp map[string]any
 	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &resp))
 	return resp
 }
 func TestBrainReadAndEdit_RoundTripThroughJSONRPC(t *testing.T) {
 	// The Go functions are tested in internal/notes; this pins the transport,
 	// because a tool that works in-process and is unreachable over JSON-RPC
 	// is indistinguishable from a working one in a unit test.
 	dir := newBrainRepo(t)
 	srv := mcp.NewServer(dir, nil, nil, nil)
 	resp := call(t, srv, "brain_read", map[string]any{"path": "wiki/homelab/facts/n.md"})
 	require.NotContains(t, resp, "error", "%v", resp["error"])
 	resp = call(t, srv, "brain_edit", map[string]any{
 		"path": "wiki/homelab/facts/n.md", "old_str": "beta", "new_str": "BETA",
 	})
 	require.NotContains(t, resp, "error", "%v", resp["error"])
 	got, err := os.ReadFile(filepath.Join(dir, "wiki/homelab/facts/n.md"))
 	require.NoError(t, err)
 	// Only the matched bytes change in the body; the one deliberate addition
 	// is the editor's provenance stamp (hyperguild#145 — no principal here,
 	// so origin: unknown).
 	assert.Equal(t, "---\ntitle: 'n'\norigin: unknown\n---\n\nalpha\nBETA\n", string(got),
 		"only the matched bytes and the provenance stamp may change")
 }
 func TestBrainEdit_EmptyOldStrErrorNamesRawArgumentBytes(t *testing.T) {
 	// hyperguild#115: a session reported "old_str is empty" with an old_str
 	// that, on their end, was never empty. The server-side path was
 	// unreachable to reproduce (verified separately: a fresh brain_edit call
 	// with real content round-trips cleanly), which points at something
 	// between a specific client and this call losing the field. The fix this
 	// issue actually asked for isn't a behavior change — old_str=="" must
 	// still refuse — it's that the refusal should say how many raw argument
 	// bytes it received, so "client sent empty" is distinguishable from
 	// "server received empty after some hop lost it" without a second
 	// session's worth of guessing.
 	dir := newBrainRepo(t)
 	srv := mcp.NewServer(dir, nil, nil, nil)
 	resp := call(t, srv, "brain_edit", map[string]any{
 		"path": "wiki/homelab/facts/n.md", "old_str": "", "new_str": "BETA",
 	})
 	errMsg, ok := resp["error"].(map[string]any)["message"].(string)
 	require.True(t, ok, "%v", resp)
 	assert.Contains(t, errMsg, "old_str is empty")
 	assert.Contains(t, errMsg, "raw arguments were", "%v", errMsg)
 }
 func TestBrainEdit_RejectsAnInvalidClaimEnvelopeWrittenViaStringReplace(t *testing.T) {
 	// hyperguild#123: brain_write/brain_update both validate the claim
 	// envelope (half_life/applies/claim_provenance) before writing —
 	// brain_edit didn't, even though it's the one live, model-facing path
 	// that can rewrite an existing envelope line directly via raw string
 	// replace, no parsing involved. "same rules when a note changes as when
 	// it's born" (hyperguild#111's own framing) applies here too.
 	dir := newBrainRepo(t)
 	note := filepath.Join(dir, "wiki/homelab/facts/n.md")
 	require.NoError(t, os.WriteFile(note,
 		[]byte("---\ntitle: 'n'\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\n\nbody\n"), 0o644))
 	srv := mcp.NewServer(dir, nil, nil, nil)
 	resp := call(t, srv, "brain_edit", map[string]any{
 		"path": "wiki/homelab/facts/n.md", "old_str": "claim_provenance: asserted", "new_str": "claim_provenance: guessed",
 	})
 	require.Contains(t, resp, "error", "%v", resp)
 	got, err := os.ReadFile(note)
 	require.NoError(t, err)
 	assert.Contains(t, string(got), "claim_provenance: asserted", "rejected edit must leave the note byte-identical")
 }
 func TestBrainEdit_RejectsAValueOnlyEditThatBreaksTheEnvelope(t *testing.T) {
 	// Found in review: the original gate (touchesClaimEnvelope) checked
 	// whether old_str/new_str mention the FIELD NAME — but a minimal diff
 	// (the natural shape of any real edit, model-generated or human) can
 	// target just the VALUE token and never mention the field name at all.
 	// "asserted" -> "guessed" on a claim_provenance line walked straight
 	// past the field-name substring check and wrote an invalid enum value
 	// with no error — the exact bypass #123 was supposed to close, closed
 	// in name only.
 	dir := newBrainRepo(t)
 	note := filepath.Join(dir, "wiki/homelab/facts/n.md")
 	require.NoError(t, os.WriteFile(note,
 		[]byte("---\ntitle: 'n'\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\n\nbody\n"), 0o644))
 	srv := mcp.NewServer(dir, nil, nil, nil)
 	resp := call(t, srv, "brain_edit", map[string]any{
 		"path": "wiki/homelab/facts/n.md", "old_str": "asserted", "new_str": "guessed",
 	})
 	require.Contains(t, resp, "error", "%v", resp)
 	got, err := os.ReadFile(note)
 	require.NoError(t, err)
 	assert.Contains(t, string(got), "claim_provenance: asserted", "rejected edit must leave the note byte-identical")
 }
 func TestBrainEdit_RejectsAnOldStrThatCrossesTheClosingFence(t *testing.T) {
 	// Found in round-2 review: the position-based gate required old_str to
 	// be fully CONTAINED in the extracted frontmatter block (which excludes
 	// both "---" fence lines). An old_str disambiguated by extending past
 	// the closing fence into the body — a natural choice, since notes.Edit
 	// requires old_str to be unique in the file — fails that containment
 	// test, so checkClaimEnvelope skips validation entirely while
 	// notes.Edit still applies the replace verbatim. Same invalid-enum
 	// outcome as the original two bypasses, reached a third way.
 	dir := newBrainRepo(t)
 	note := filepath.Join(dir, "wiki/homelab/facts/n.md")
 	require.NoError(t, os.WriteFile(note,
 		[]byte("---\ntitle: 'n'\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\n\nbody\n"), 0o644))
 	srv := mcp.NewServer(dir, nil, nil, nil)
 	resp := call(t, srv, "brain_edit", map[string]any{
 		"path":    "wiki/homelab/facts/n.md",
 		"old_str": "asserted\n---\n\nbody",
 		"new_str": "guessed\n---\n\nbody",
 	})
 	require.Contains(t, resp, "error", "%v", resp)
 	got, err := os.ReadFile(note)
 	require.NoError(t, err)
 	assert.Contains(t, string(got), "claim_provenance: asserted", "rejected edit must leave the note byte-identical")
 }
 func TestBrainEdit_RejectsAnEditThatRemovesTheClosingFence(t *testing.T) {
 	// Found in round-3 review: checkClaimEnvelope always validates the
 	// resulting frontmatter of `after` — but an edit whose new_str drops
 	// the closing "---" degrades `after` to "unfenced" in the same call.
 	// frontmatterBlock(after) then returns ok=false, frontmatterScalars
 	// returns an empty map, and claim.ValidateEnvelope({}) is nil by
 	// design (absent fields are valid) — so an invalid enum value lands on
 	// disk with zero error, and the note is left permanently unfenced.
 	// Structural fix: a note that had a valid fence before the edit must
 	// still have one after, or the edit is rejected outright.
 	dir := newBrainRepo(t)
 	note := filepath.Join(dir, "wiki/homelab/facts/n.md")
 	require.NoError(t, os.WriteFile(note,
 		[]byte("---\ntitle: 'n'\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\n\nbody\n"), 0o644))
 	srv := mcp.NewServer(dir, nil, nil, nil)
 	resp := call(t, srv, "brain_edit", map[string]any{
 		"path":    "wiki/homelab/facts/n.md",
 		"old_str": "claim_provenance: asserted\n---\n",
 		"new_str": "claim_provenance: not-a-real-value\n",
 	})
 	require.Contains(t, resp, "error", "%v", resp)
 	got, err := os.ReadFile(note)
 	require.NoError(t, err)
 	assert.Contains(t, string(got), "claim_provenance: asserted\n---\n", "rejected edit must leave the note byte-identical, fence intact")
 }
 func TestBrainEdit_RejectsAnInvalidEnvelopeOnACRLFFencedNote(t *testing.T) {
 	// Found in round-4 review: frontmatterBlock's fence detection matches
 	// the literal byte sequence "---\n" / "\n---\n". A note whose fence
 	// lines use CRLF ("---\r\n") fails strings.HasPrefix(doc, "---\n") on
 	// the BEFORE read, so hadFence is false — not because the fence is
 	// missing, but because \r sits in front of every \n. hadFence&&!hasFence
 	// can then never fire, frontmatterScalars falls back to an empty map,
 	// and claim.ValidateEnvelope({}) is nil by design. No adversarial
 	// old_str/new_str crafting needed: encoding alone silently disables the
 	// whole envelope check for this note. Zero CRLF-fenced notes exist in
 	// the live corpus today, but nothing in the code prevents one.
 	dir := newBrainRepo(t)
 	note := filepath.Join(dir, "wiki/homelab/facts/n.md")
 	require.NoError(t, os.WriteFile(note,
 		[]byte("---\r\ntitle: 'n'\r\nhalf_life: durable\r\napplies: universal\r\nclaim_provenance: asserted\r\n---\r\n\r\nbody\r\n"), 0o644))
 	srv := mcp.NewServer(dir, nil, nil, nil)
 	resp := call(t, srv, "brain_edit", map[string]any{
 		"path": "wiki/homelab/facts/n.md", "old_str": "asserted", "new_str": "guessed",
 	})
 	require.Contains(t, resp, "error", "%v", resp)
 	got, err := os.ReadFile(note)
 	require.NoError(t, err)
 	assert.Contains(t, string(got), "claim_provenance: asserted", "rejected edit must leave the note byte-identical")
 }
 func TestBrainEdit_RejectsAnInvalidEnvelopeOnABOMPrefixedNote(t *testing.T) {
 	// Found in round-5 review: the same "encoding property empties
 	// frontmatterScalars's map" mechanism as the CRLF bypass, one layer
 	// earlier — a leading UTF-8 BOM (EF BB BF) defeats
 	// strings.HasPrefix(doc, "---\n") exactly like CRLF did, before that
 	// prefix is even reached. Notepad's default "UTF-8" save and
 	// PowerShell's pre-v6 Out-File/Set-Content both emit a BOM, so this is
 	// a live, plausible authoring path, not an exotic one — same severity
 	// and same one-line cost as the CRLF fix, fixed the same way rather
 	// than deferred to hyperguild#138.
 	dir := newBrainRepo(t)
 	note := filepath.Join(dir, "wiki/homelab/facts/n.md")
 	require.NoError(t, os.WriteFile(note,
 		[]byte("\xef\xbb\xbf---\ntitle: 'n'\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\n\nbody\n"), 0o644))
 	srv := mcp.NewServer(dir, nil, nil, nil)
 	resp := call(t, srv, "brain_edit", map[string]any{
 		"path": "wiki/homelab/facts/n.md", "old_str": "asserted", "new_str": "guessed",
 	})
 	require.Contains(t, resp, "error", "%v", resp)
 	got, err := os.ReadFile(note)
 	require.NoError(t, err)
 	assert.Contains(t, string(got), "claim_provenance: asserted", "rejected edit must leave the note byte-identical")
 }
 func TestBrainEdit_RejectsAFoldedScalarThatHidesAnInvalidValue(t *testing.T) {
 	// Found in round-6 review: a different mechanism from the encoding
 	// family (rounds 1-6 were all about fence detection; this is the field
 	// extractor). old_str="half_life: durable", new_str="half_life:\n
 	// garbage-value" turns the field into a YAML block-scalar shape: the
 	// top-level line is now "half_life:" with an empty inline value, and
 	// the real value lives on the indented continuation line that follows.
 	// frontmatterScalars's indentation guard skips that continuation line
 	// outright, so the field reads as present-with-empty-value —
 	// present()'s own contract then treats that as absent (a placeholder,
 	// not an assertion) — and claim.ValidateEnvelope never sees the
 	// invalid value at all. No encoding quirk needed: one ordinary
 	// brain_edit call smuggles an out-of-enum value straight past the
 	// check the field was supposed to be validated by.
 	dir := newBrainRepo(t)
 	note := filepath.Join(dir, "wiki/homelab/facts/n.md")
 	require.NoError(t, os.WriteFile(note,
 		[]byte("---\ntitle: 'n'\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\n\nbody\n"), 0o644))
 	srv := mcp.NewServer(dir, nil, nil, nil)
 	resp := call(t, srv, "brain_edit", map[string]any{
 		"path":    "wiki/homelab/facts/n.md",
 		"old_str": "half_life: durable",
 		"new_str": "half_life:\n  garbage-value",
 	})
 	require.Contains(t, resp, "error", "%v", resp)
 	got, err := os.ReadFile(note)
 	require.NoError(t, err)
 	assert.Contains(t, string(got), "half_life: durable", "rejected edit must leave the note byte-identical")
 }
 func TestBrainEdit_AllowsAValidClaimEnvelopeEdit(t *testing.T) {
 	dir := newBrainRepo(t)
 	note := filepath.Join(dir, "wiki/homelab/facts/n.md")
 	require.NoError(t, os.WriteFile(note,
 		[]byte("---\ntitle: 'n'\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\n\nbody\n"), 0o644))
 	srv := mcp.NewServer(dir, nil, nil, nil)
 	resp := call(t, srv, "brain_edit", map[string]any{
 		"path": "wiki/homelab/facts/n.md", "old_str": "half_life: durable", "new_str": "half_life: seasonal",
 	})
 	require.NotContains(t, resp, "error", "%v", resp)
 	got, err := os.ReadFile(note)
 	require.NoError(t, err)
 	assert.Contains(t, string(got), "half_life: seasonal")
 }
 func TestBrainEdit_UnrelatedEditsSkipTheEnvelopeCheckEntirely(t *testing.T) {
 	// The gate only engages when old_str/new_str actually mention an
 	// envelope field name — an ordinary body edit on a note that happens to
 	// carry a valid envelope must not pay for (or be affected by) a check
 	// that has nothing to do with it.
 	dir := newBrainRepo(t)
 	note := filepath.Join(dir, "wiki/homelab/facts/n.md")
 	require.NoError(t, os.WriteFile(note,
 		[]byte("---\ntitle: 'n'\nhalf_life: durable\napplies: universal\nclaim_provenance: asserted\n---\n\nold body\n"), 0o644))
 	srv := mcp.NewServer(dir, nil, nil, nil)
 	resp := call(t, srv, "brain_edit", map[string]any{
 		"path": "wiki/homelab/facts/n.md", "old_str": "old body", "new_str": "new body",
 	})
 	require.NotContains(t, resp, "error", "%v", resp)
 	got, err := os.ReadFile(note)
 	require.NoError(t, err)
 	assert.Contains(t, string(got), "new body")
 }
 func TestBrainEditRoot_GovernanceFilesAreNeverEnvelopeChecked(t *testing.T) {
 	// CLAUDE.md has no claim-envelope concept at all — the check must be
 	// scoped to notes (ScopeNotes), never applied on the governance path.
 	srv, _, _, _ := govServer(t)
 	resp := authCall(t, srv, "Bearer "+capStaticTok, "brain_edit_root", map[string]any{
 		"path": "CLAUDE.md", "old_str": "# rules", "new_str": "half_life: durable",
 	})
 	require.NotContains(t, resp, "error", "%v", resp)
 }
 func TestBrainEdit_RefusesGovernanceFilesFromTheModelFacingTool(t *testing.T) {
 	dir := newBrainRepo(t)
 	srv := mcp.NewServer(dir, nil, nil, nil)
 	resp := call(t, srv, "brain_edit", map[string]any{
 		"path": "CLAUDE.md", "old_str": "# rules", "new_str": "# rewritten",
 	})
 	require.Contains(t, resp, "error", "brain_edit must not reach CLAUDE.md")
 	got, err := os.ReadFile(filepath.Join(dir, "CLAUDE.md"))
 	require.NoError(t, err)
 	assert.Equal(t, "# rules\n", string(got))
 }
 func TestBrainEditRoot_RefusedWithoutTheLocalStaticPrincipal(t *testing.T) {
 	// No principal in context is the model-facing case (and the default in
 	// this test server): the privileged door must stay shut.
 	dir := newBrainRepo(t)
 	srv := mcp.NewServer(dir, nil, nil, nil)
 	resp := call(t, srv, "brain_edit_root", map[string]any{
 		"path": "CLAUDE.md", "old_str": "# rules", "new_str": "# rewritten",
 	})
 	require.Contains(t, resp, "error")
 	got, err := os.ReadFile(filepath.Join(dir, "CLAUDE.md"))
 	require.NoError(t, err)
 	assert.Equal(t, "# rules\n", string(got), "governance file must be untouched")
 }
 func TestBrainGet_CannotReachSessionTranscripts(t *testing.T) {
 	// Pre-existing hole, not introduced here: api.ReadNote resolves any
 	// brain-relative path and parseFrontmatter returns the WHOLE file as body
 	// when there is no frontmatter fence. archive/ holds verbatim Claude
 	// session transcripts (up to 500 KB) that BM25 never indexes, so they are
 	// invisible to search and trivially readable by path — and CLAUDE.md
 	// documents the layout.
 	dir := newBrainRepo(t)
 	require.NoError(t, os.MkdirAll(filepath.Join(dir, "archive/claude-sessions/koala"), 0o755))
 	require.NoError(t, os.WriteFile(
 		filepath.Join(dir, "archive/claude-sessions/koala/session-1.md"),
 		[]byte("verbatim transcript with tool output\n"), 0o644))
 	srv := mcp.NewServer(dir, nil, nil, nil)
 	resp := call(t, srv, "brain_get", map[string]any{"path": "archive/claude-sessions/koala/session-1.md"})
 	require.Contains(t, resp, "error", "brain_get must not read outside knowledge/ and wiki/")
 	assert.NotContains(t, string(mustJSON(t, resp)), "verbatim transcript")
 }
 func TestBrainGet_StillReadsNotes(t *testing.T) {
 	dir := newBrainRepo(t)
 	srv := mcp.NewServer(dir, nil, nil, nil)
 	resp := call(t, srv, "brain_get", map[string]any{"path": "wiki/homelab/facts/n.md"})
 	assert.NotContains(t, resp, "error", "%v", resp["error"])
 }
 func mustJSON(t *testing.T, v any) []byte {
 	t.Helper()
 	b, err := json.Marshal(v)
 	require.NoError(t, err)
 	return b
 }
 // ---- hyperguild#97: a governance rewrite must be observed, not just gated ----
 // govSink captures audit records. Governance edits are rare, so the whole
 // history is kept and asserted on rather than sampled.
 type govSink struct {
 	entries  []capture.AuditEntry
 	outcomes []capture.AuditOutcome
 	recErr   error
 }
 func (s *govSink) Reserve(context.Context, classification.Level) (capture.AuditOutcome, error) {
 	return capture.AuditCentral, nil
 }
 func (s *govSink) Record(_ context.Context, e capture.AuditEntry, o capture.AuditOutcome) error {
 	s.entries = append(s.entries, e)
 	s.outcomes = append(s.outcomes, o)
 	return s.recErr
 }
 type govNotifier struct {
 	msgs []string
 	err  error
 }
 func (n *govNotifier) Notify(_ context.Context, msg string) error {
 	n.msgs = append(n.msgs, msg)
 	return n.err
 }
 // govServer wires capture (which is what re-derives the static principal) plus
 // the #97 observer, and returns the brain dir so the test can read the file.
 func govServer(t *testing.T) (*mcp.Server, string, *govSink, *govNotifier) {
 	t.Helper()
 	dir := newBrainRepo(t)
 	cfg, err := classification.Load(dir)
 	require.NoError(t, err)
 	svc := capture.NewService(brainstore.New(dir), capFakeTracker{}, cfg, audit.NewSlogSink(nil))
 	srv := mcp.NewServer(dir, nil, nil, nil)
 	srv.WithCapture(svc, nil, capStaticTok, "local-cli", capturehttp.NewOriginResolver(nil))
 	sink, notifier := &govSink{}, &govNotifier{}
 	srv.WithGovernanceObserver(sink, notifier)
 	return srv, dir, sink, notifier
 }
 // authCall is call() with an Authorization header, so the static principal is
 // present and brain_edit_root's gate opens.
 func authCall(t *testing.T, srv *mcp.Server, authz, name string, args map[string]any) map[string]any {
 	t.Helper()
 	req := httptest.NewRequest(http.MethodPost, "/mcp", body(t, map[string]any{
 		"jsonrpc": "2.0", "id": 1, "method": "tools/call",
 		"params": map[string]any{"name": name, "arguments": args},
 	}))
 	if authz != "" {
 		req.Header.Set("Authorization", authz)
 	}
 	rr := httptest.NewRecorder()
 	srv.ServeHTTP(rr, req)
 	var resp map[string]any
 	require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &resp))
 	return resp
 }
 func sha256hex(s string) string {
 	sum := sha256.Sum256([]byte(s))
 	return hex.EncodeToString(sum[:])
 }
 func TestBrainEditRoot_RecordsAnAuditEntryNamingPrincipalPathAndBothHashes(t *testing.T) {
 	// The gate proves a rewrite was ALLOWED. Only a record proves one HAPPENED
 	// — and brain-sync will commit it within 15 minutes authored `brain-sync`,
 	// so git history cannot tell it apart from routine note traffic.
 	srv, dir, sink, _ := govServer(t)
 	resp := authCall(t, srv, "Bearer "+capStaticTok, "brain_edit_root", map[string]any{
 		"path": "CLAUDE.md", "old_str": "# rules", "new_str": "# rewritten",
 	})
 	require.NotContains(t, resp, "error", "%v", resp["error"])
 	require.Len(t, sink.entries, 1, "exactly one audit record per governance rewrite")
 	e := sink.entries[0]
 	assert.Equal(t, "local-cli", e.Principal)
 	assert.Contains(t, e.Items, "CLAUDE.md", "the record must name what was rewritten")
 	joined := strings.Join(e.SecurityEvents, " ")
 	assert.Contains(t, joined, sha256hex("# rules\n"), "before-hash must be recorded")
 	assert.Contains(t, joined, sha256hex("# rewritten\n"), "after-hash must be recorded")
 	assert.NotZero(t, e.Timestamp)
 	got, err := os.ReadFile(filepath.Join(dir, "CLAUDE.md"))
 	require.NoError(t, err)
 	assert.Equal(t, "# rewritten\n", string(got))
 }
 func TestBrainEditRoot_NotifiesWithPathAndHashesButNeverContent(t *testing.T) {
 	srv, _, _, notifier := govServer(t)
 	resp := authCall(t, srv, "Bearer "+capStaticTok, "brain_edit_root", map[string]any{
 		"path": "CLAUDE.md", "old_str": "# rules", "new_str": "# rewritten",
 	})
 	require.NotContains(t, resp, "error", "%v", resp["error"])
 	require.Len(t, notifier.msgs, 1)
 	msg := notifier.msgs[0]
 	assert.Contains(t, msg, "CLAUDE.md")
 	assert.Contains(t, msg, "local-cli")
 	assert.Contains(t, msg, sha256hex("# rules\n"))
 	assert.Contains(t, msg, sha256hex("# rewritten\n"))
 	// The notification travels to a phone through a third-party topic. A hash
 	// identifies a rewrite; the bytes would leak whatever was written.
 	assert.NotContains(t, msg, "# rewritten", "no file content in the notification body")
 	assert.NotContains(t, msg, "# rules")
 }
 func TestBrainEditRoot_RefusedProducesNoRecordNoNotificationNoWrite(t *testing.T) {
 	srv, dir, sink, notifier := govServer(t)
 	// No Authorization header → no static principal → the gate stays shut.
 	resp := authCall(t, srv, "", "brain_edit_root", map[string]any{
 		"path": "CLAUDE.md", "old_str": "# rules", "new_str": "# rewritten",
 	})
 	require.Contains(t, resp, "error")
 	assert.Empty(t, sink.entries, "a refusal is not a rewrite — recording one would cry wolf")
 	assert.Empty(t, notifier.msgs)
 	got, err := os.ReadFile(filepath.Join(dir, "CLAUDE.md"))
 	require.NoError(t, err)
 	assert.Equal(t, "# rules\n", string(got))
 }
 func TestBrainEditRoot_FailedEditProducesNoRecordNoNotification(t *testing.T) {
 	// Authorised but no match: the door opened and nothing went through it.
 	srv, _, sink, notifier := govServer(t)
 	resp := authCall(t, srv, "Bearer "+capStaticTok, "brain_edit_root", map[string]any{
 		"path": "CLAUDE.md", "old_str": "absent-from-the-file", "new_str": "x",
 	})
 	require.Contains(t, resp, "error")
 	assert.Empty(t, sink.entries)
 	assert.Empty(t, notifier.msgs)
 }
 func TestBrainEdit_OnOrdinaryNotesIsNotAudited(t *testing.T) {
 	// The decided asymmetry (#97): note edits are covered by git history, which
 	// carries the same before/after bytes with a diff. Governance files get the
 	// extra trail because they change what later agents obey, not because they
 	// are harder to reconstruct.
 	srv, _, sink, notifier := govServer(t)
 	resp := authCall(t, srv, "Bearer "+capStaticTok, "brain_edit", map[string]any{
 		"path": "wiki/homelab/facts/n.md", "old_str": "beta", "new_str": "BETA",
 	})
 	require.NotContains(t, resp, "error", "%v", resp["error"])
 	assert.Empty(t, sink.entries, "note edits must not fill the governance audit trail")
 	assert.Empty(t, notifier.msgs)
 }
@@ -1,282 +0,0 @@
 package notes
 import (
 	"crypto/sha256"
 	"encoding/hex"
 	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
 	"sync"
 	"syscall"
 	"unicode/utf8"
 )
 // maxNoteBytes caps what Read will hand back. Generous for knowledge/ and
 // wiki/ (the largest note today is far under it) and small enough that a
 // pathological file cannot flood a caller's context.
 const maxNoteBytes = 256 << 10
 // Errors callers distinguish.
 var (
 	ErrNoMatch    = errors.New("notes: old_str not found")
 	ErrAmbiguous  = errors.New("notes: old_str matches more than once")
 	ErrNotUTF8    = errors.New("notes: content is not valid UTF-8")
 	ErrGitBusy    = errors.New("notes: a git operation is in progress")
 	ErrTooLarge   = errors.New("notes: file exceeds the readable size limit")
 	ErrDegenerate = errors.New("notes: edit is degenerate")
 	ErrInConflict = errors.New("notes: file contains unresolved conflict markers")
 )
 // pathLocks serialises edits per file within this process. The flock below
 // covers the cross-process case (two pods share the hostPath during a rolling
 // update, and brain-fix/brain-enrich write the same tree).
 var pathLocks sync.Map // string -> *sync.Mutex
 // Result is what a successful edit reports.
 type Result struct {
 	Path string `json:"path"`
 	// PrevContentHash is the sha256 of the file as it was before this edit.
 	// Paired with ContentHash it identifies a rewrite in an audit trail or an
 	// alert without carrying any of the bytes (hyperguild#97).
 	PrevContentHash string `json:"prev_content_hash"`
 	ContentHash     string `json:"content_hash"`
 	BytesBefore     int    `json:"bytes_before"`
 	BytesAfter      int    `json:"bytes_after"`
 	ReindexError    string `json:"reindex_error,omitempty"`
 }
 // Read returns a note's bytes verbatim.
 //
 // No frontmatter parsing, no excerpting, no normalisation: the entire purpose
 // is to give a caller an exact basis for an edit. An excerpt from brain_query
 // would be truncated and normalised, and every old_str built from one would
 // miss.
 func Read(brainDir, path string) ([]byte, error) {
 	t, err := Resolve(brainDir, path, ScopeNotes)
 	if err != nil {
 		return nil, err
 	}
 	return readContained(t)
 }
 // ReadScoped is Read for a caller already holding the privileged scope.
 func ReadScoped(brainDir, path string, scope Scope) ([]byte, error) {
 	t, err := Resolve(brainDir, path, scope)
 	if err != nil {
 		return nil, err
 	}
 	return readContained(t)
 }
 func readContained(t Target) ([]byte, error) {
 	fi, err := os.Stat(t.Abs)
 	if err != nil {
 		return nil, fmt.Errorf("notes: stat %s: %w", t.Rel, err)
 	}
 	if fi.Size() > maxNoteBytes {
 		return nil, fmt.Errorf("%w: %s is %d bytes (limit %d)", ErrTooLarge, t.Rel, fi.Size(), maxNoteBytes)
 	}
 	b, err := os.ReadFile(t.Abs)
 	if err != nil {
 		return nil, fmt.Errorf("notes: read %s: %w", t.Rel, err)
 	}
 	// The MCP response marshals this into a JSON string, and encoding/json
 	// substitutes U+FFFD for invalid UTF-8 — silently returning different
 	// bytes than the file holds, which defeats "verbatim" entirely.
 	if !utf8.Valid(b) {
 		return nil, fmt.Errorf("%w: %s", ErrNotUTF8, t.Rel)
 	}
 	return b, nil
 }
 // Edit replaces exactly one occurrence of oldStr with newStr, in place.
 //
 // Fails loudly and writes nothing on: zero matches, more than one match
 // (counted with overlap), degenerate arguments, invalid UTF-8, a git operation
 // in flight, or unresolved conflict markers in the target.
 func Edit(brainDir, path, oldStr, newStr string, scope Scope) (Result, error) {
 	t, err := Resolve(brainDir, path, scope)
 	if err != nil {
 		return Result{}, err
 	}
 	if oldStr == "" {
 		return Result{}, fmt.Errorf("%w: old_str is empty", ErrDegenerate)
 	}
 	if oldStr == newStr {
 		return Result{}, fmt.Errorf("%w: old_str equals new_str", ErrDegenerate)
 	}
 	if !utf8.ValidString(newStr) {
 		return Result{}, fmt.Errorf("%w: new_str", ErrNotUTF8)
 	}
 	// brain#2 guard: refuse to write to a tree the sync does not commit from.
 	if err := assertSyncSource(brainDir); err != nil {
 		return Result{}, err
 	}
 	if err := assertGitIdle(brainDir); err != nil {
 		return Result{}, err
 	}
 	mu := lockFor(t.Abs)
 	mu.Lock()
 	defer mu.Unlock()
 	unlock, err := flockFile(t.Abs)
 	if err != nil {
 		return Result{}, err
 	}
 	defer unlock()
 	// Read INSIDE the lock: the match count must be evaluated against the
 	// bytes we are about to overwrite, or a concurrent edit is silently lost
 	// while both callers are told they succeeded.
 	before, err := readContained(t)
 	if err != nil {
 		return Result{}, err
 	}
 	if hasConflictMarkers(before) {
 		return Result{}, fmt.Errorf("%w: %s", ErrInConflict, t.Rel)
 	}
 	switch n := countOverlapping(string(before), oldStr); {
 	case n == 0:
 		return Result{}, fmt.Errorf("%w in %s (0 matches)%s", ErrNoMatch, t.Rel, crlfHint(string(before), oldStr))
 	case n > 1:
 		return Result{}, fmt.Errorf("%w in %s (%d matches) — extend old_str until it is unique",
 			ErrAmbiguous, t.Rel, n)
 	}
 	after := strings.Replace(string(before), oldStr, newStr, 1)
 	if err := writeAtomic(t.Abs, []byte(after)); err != nil {
 		return Result{}, err
 	}
 	sum := sha256.Sum256([]byte(after))
 	prev := sha256.Sum256(before)
 	return Result{
 		Path:            t.Rel,
 		PrevContentHash: hex.EncodeToString(prev[:]),
 		ContentHash:     hex.EncodeToString(sum[:]),
 		BytesBefore:     len(before),
 		BytesAfter:      len(after),
 	}, nil
 }
 // countOverlapping counts occurrences allowing overlap. bytes.Count does not:
 // "aa" occurs once in "aaa" by its reckoning, so a Count-based uniqueness
 // check accepts an ambiguous edit as unique.
 func countOverlapping(s, sub string) int {
 	var n, from int
 	for {
 		i := strings.Index(s[from:], sub)
 		if i < 0 {
 			return n
 		}
 		n++
 		from += i + 1
 	}
 }
 // crlfHint reports whether the caller's old_str would have matched if line
 // endings agreed. It never normalises — that would break byte-identity — but
 // an opaque "no match" is unfixable from the caller's side, and a stripped \r
 // is the likeliest cause.
 func crlfHint(content, oldStr string) string {
 	if strings.Contains(content, "\r\n") && !strings.Contains(oldStr, "\r\n") {
 		if strings.Contains(strings.ReplaceAll(content, "\r\n", "\n"), oldStr) {
 			return " — the file uses CRLF line endings and old_str does not; include the \\r"
 		}
 	}
 	return ""
 }
 func hasConflictMarkers(b []byte) bool {
 	s := string(b)
 	return strings.Contains(s, "\n<<<<<<< ") || strings.HasPrefix(s, "<<<<<<< ")
 }
 // assertGitIdle refuses while brain-sync (or brain-fix, or a human) has a git
 // operation in flight. An edit landing between `git merge` and its abort is
 // either hard-reset away or committed as a wrongly resolved conflict — and the
 // caller was told it succeeded.
 func assertGitIdle(brainDir string) error {
 	for _, marker := range []string{"MERGE_HEAD", "REBASE_HEAD", "CHERRY_PICK_HEAD", "index.lock"} {
 		if _, err := os.Stat(filepath.Join(brainDir, ".git", marker)); err == nil {
 			return fmt.Errorf("%w (.git/%s present) — retry after the sync settles", ErrGitBusy, marker)
 		}
 	}
 	return nil
 }
 func lockFor(abs string) *sync.Mutex {
 	v, _ := pathLocks.LoadOrStore(abs, &sync.Mutex{})
 	return v.(*sync.Mutex)
 }
 // flockFile takes an advisory lock covering other processes sharing the
 // hostPath — during a RollingUpdate two ingestion pods do.
 func flockFile(abs string) (func(), error) {
 	f, err := os.OpenFile(abs+".lock", os.O_CREATE|os.O_RDWR, 0o644)
 	if err != nil {
 		return nil, fmt.Errorf("notes: lock %s: %w", filepath.Base(abs), err)
 	}
 	if err := syscall.Flock(int(f.Fd()), syscall.LOCK_EX); err != nil {
 		_ = f.Close()
 		return nil, fmt.Errorf("notes: flock %s: %w", filepath.Base(abs), err)
 	}
 	return func() {
 		_ = syscall.Flock(int(f.Fd()), syscall.LOCK_UN)
 		_ = f.Close()
 		_ = os.Remove(abs + ".lock")
 	}, nil
 }
 // writeAtomic replaces the file via a same-directory temp + rename, then
 // fsyncs the directory so the rename survives a node crash.
 //
 // Same directory because a rename across the hostPath boundary fails with
 // EXDEV; the ".tmp" suffix because the tree's .gitignore already covers it, so
 // a leaked temp is not committed by `git add -A`.
 func writeAtomic(abs string, content []byte) error {
 	dir := filepath.Dir(abs)
 	tmp, err := os.CreateTemp(dir, filepath.Base(abs)+".*.tmp")
 	if err != nil {
 		return fmt.Errorf("notes: temp file: %w", err)
 	}
 	tmpName := tmp.Name()
 	defer func() { _ = os.Remove(tmpName) }() // no-op once renamed
 	if _, err := tmp.Write(content); err != nil {
 		_ = tmp.Close()
 		return fmt.Errorf("notes: write temp: %w", err)
 	}
 	if err := tmp.Sync(); err != nil {
 		_ = tmp.Close()
 		return fmt.Errorf("notes: sync temp: %w", err)
 	}
 	if err := tmp.Close(); err != nil {
 		return fmt.Errorf("notes: close temp: %w", err)
 	}
 	// CreateTemp makes 0600; every other writer of this tree uses 0644 and
 	// other uids read it.
 	if err := os.Chmod(tmpName, 0o644); err != nil {
 		return fmt.Errorf("notes: chmod temp: %w", err)
 	}
 	if err := os.Rename(tmpName, abs); err != nil {
 		return fmt.Errorf("notes: rename: %w", err)
 	}
 	return fsyncDir(dir)
 }
 func fsyncDir(dir string) error {
 	d, err := os.Open(dir)
 	if err != nil {
 		return fmt.Errorf("notes: open dir: %w", err)
 	}
 	defer func() { _ = d.Close() }()
 	if err := d.Sync(); err != nil {
 		return fmt.Errorf("notes: fsync dir: %w", err)
 	}
 	return nil
 }
@@ -1,256 +0,0 @@
 package notes
 import (
 	"os"
 	"path/filepath"
 	"strings"
 	"sync"
 	"testing"
 )
 func seed(t *testing.T, dir, rel, content string) string {
 	t.Helper()
 	abs := filepath.Join(dir, rel)
 	if err := os.MkdirAll(filepath.Dir(abs), 0o755); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(abs, []byte(content), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	return abs
 }
 func read(t *testing.T, abs string) string {
 	t.Helper()
 	b, err := os.ReadFile(abs)
 	if err != nil {
 		t.Fatal(err)
 	}
 	return string(b)
 }
 func TestRead_ReturnsVerbatimBytes(t *testing.T) {
 	dir := newBrain(t)
 	const body = "---\ntitle: 'x'\n---\n\nbody with  double  spaces\r\nand a CRLF line\nno trailing newline"
 	seed(t, dir, "knowledge/verbatim.md", body)
 	got, err := Read(dir, "knowledge/verbatim.md")
 	if err != nil {
 		t.Fatalf("Read: %v", err)
 	}
 	if string(got) != body {
 		t.Errorf("Read returned %q, want the file byte-for-byte", got)
 	}
 }
 func TestRead_RefusesNonUTF8RatherThanCorruptingIt(t *testing.T) {
 	// The response is marshalled into a JSON string, and encoding/json
 	// replaces invalid UTF-8 with U+FFFD. Returning it would mean every
 	// old_str the caller derives from that region can never match, and
 	// pasting it back would write the corruption to disk permanently.
 	dir := newBrain(t)
 	seed(t, dir, "knowledge/bad.md", "ok \xff\xfe broken\n")
 	if _, err := Read(dir, "knowledge/bad.md"); err == nil {
 		t.Fatal("Read accepted invalid UTF-8; it must refuse rather than silently substitute")
 	}
 }
 func TestEdit_ReplacesExactlyOnceAndLeavesEveryOtherByteAlone(t *testing.T) {
 	dir := newBrain(t)
 	const body = "---\ntitle: 'x'\n---\n\nalpha\nbeta\ngamma\n"
 	abs := seed(t, dir, "knowledge/n.md", body)
 	res, err := Edit(dir, "knowledge/n.md", "beta", "BETA", ScopeNotes)
 	if err != nil {
 		t.Fatalf("Edit: %v", err)
 	}
 	want := strings.Replace(body, "beta", "BETA", 1)
 	if got := read(t, abs); got != want {
 		t.Errorf("file = %q, want %q", got, want)
 	}
 	if res.ContentHash == "" {
 		t.Error("result should carry a content hash for read-after-write confirmation")
 	}
 }
 func TestEdit_RefusesAmbiguousAndAbsentMatchesWithoutWriting(t *testing.T) {
 	dir := newBrain(t)
 	const body = "alpha\nalpha\n"
 	abs := seed(t, dir, "knowledge/n.md", body)
 	cases := []struct{ name, old, want string }{
 		{"two matches", "alpha", "2"},
 		{"no match", "delta", "0"},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			_, err := Edit(dir, "knowledge/n.md", tc.old, "x", ScopeNotes)
 			if err == nil {
 				t.Fatal("want a loud refusal")
 			}
 			if !strings.Contains(err.Error(), tc.want) {
 				t.Errorf("error must state the match count, got %v", err)
 			}
 			if got := read(t, abs); got != body {
 				t.Errorf("file changed on a refused edit: %q", got)
 			}
 		})
 	}
 }
 func TestEdit_CountsOverlappingMatches(t *testing.T) {
 	// bytes.Count counts NON-overlapping occurrences: "aa" in "aaa" is 1, so
 	// a Count-based uniqueness check calls an ambiguous edit unique.
 	dir := newBrain(t)
 	seed(t, dir, "knowledge/n.md", "aaa\n")
 	if _, err := Edit(dir, "knowledge/n.md", "aa", "b", ScopeNotes); err == nil {
 		t.Fatal("overlapping matches must be reported as ambiguous")
 	}
 }
 func TestEdit_RejectsDegenerateArguments(t *testing.T) {
 	dir := newBrain(t)
 	seed(t, dir, "knowledge/n.md", "alpha\n")
 	if _, err := Edit(dir, "knowledge/n.md", "", "x", ScopeNotes); err == nil {
 		t.Error("empty old_str must be rejected")
 	}
 	if _, err := Edit(dir, "knowledge/n.md", "alpha", "alpha", ScopeNotes); err == nil {
 		t.Error("a no-op edit must be rejected rather than burning a sync cycle")
 	}
 }
 func TestEdit_DeletionIsLegal(t *testing.T) {
 	dir := newBrain(t)
 	abs := seed(t, dir, "knowledge/n.md", "keep\ndrop\n")
 	if _, err := Edit(dir, "knowledge/n.md", "drop\n", "", ScopeNotes); err != nil {
 		t.Fatalf("Edit: %v", err)
 	}
 	if got := read(t, abs); got != "keep\n" {
 		t.Errorf("file = %q, want %q", got, "keep\n")
 	}
 }
 func TestEdit_ReportsWhenOnlyLineEndingsDiffer(t *testing.T) {
 	// The likeliest real failure: the caller's old_str lost its \r. Never
 	// normalise silently — that breaks byte-identity — but say so, because an
 	// opaque "no match" is unfixable from the caller's side.
 	dir := newBrain(t)
 	seed(t, dir, "knowledge/n.md", "alpha\r\nbeta\r\n")
 	_, err := Edit(dir, "knowledge/n.md", "alpha\nbeta", "x", ScopeNotes)
 	if err == nil {
 		t.Fatal("want a refusal")
 	}
 	if !strings.Contains(err.Error(), "line ending") {
 		t.Errorf("error should point at CRLF, got %v", err)
 	}
 }
 func TestEdit_RefusesWhileGitIsMidOperation(t *testing.T) {
 	// brain-sync runs `git merge -X ours origin/main`, and aborts on conflict
 	// with a hard reset. An edit landing inside that window is either erased
 	// or committed as a wrongly-resolved conflict, and the caller was told it
 	// succeeded.
 	dir := newBrain(t)
 	seed(t, dir, "knowledge/n.md", "alpha\n")
 	for _, marker := range []string{"MERGE_HEAD", "index.lock", "REBASE_HEAD"} {
 		t.Run(marker, func(t *testing.T) {
 			p := filepath.Join(dir, ".git", marker)
 			if err := os.WriteFile(p, []byte("x"), 0o644); err != nil {
 				t.Fatal(err)
 			}
 			defer func() { _ = os.Remove(p) }()
 			if _, err := Edit(dir, "knowledge/n.md", "alpha", "beta", ScopeNotes); err == nil {
 				t.Errorf("edit accepted while %s exists", marker)
 			}
 		})
 	}
 }
 func TestEdit_RefusesAFileHoldingConflictMarkers(t *testing.T) {
 	dir := newBrain(t)
 	seed(t, dir, "knowledge/n.md", "<<<<<<< HEAD\nours\n=======\ntheirs\n>>>>>>> origin/main\n")
 	if _, err := Edit(dir, "knowledge/n.md", "ours", "x", ScopeNotes); err == nil {
 		t.Fatal("editing one side of an unresolved conflict must be refused")
 	}
 }
 func TestEdit_ConcurrentEditsBothApply(t *testing.T) {
 	// Read-modify-write with no lock loses one update AND reports success for
 	// both. old_str uniqueness does not protect against it: uniqueness is
 	// evaluated against the stale read.
 	dir := newBrain(t)
 	abs := seed(t, dir, "knowledge/n.md", "alpha\nbeta\n")
 	var wg sync.WaitGroup
 	errs := make([]error, 2)
 	for i, pair := range [][2]string{{"alpha", "ALPHA"}, {"beta", "BETA"}} {
 		wg.Add(1)
 		go func(i int, old, new string) {
 			defer wg.Done()
 			_, errs[i] = Edit(dir, "knowledge/n.md", old, new, ScopeNotes)
 		}(i, pair[0], pair[1])
 	}
 	wg.Wait()
 	for i, err := range errs {
 		if err != nil {
 			t.Fatalf("edit %d failed: %v", i, err)
 		}
 	}
 	if got := read(t, abs); got != "ALPHA\nBETA\n" {
 		t.Errorf("file = %q, want both edits applied", got)
 	}
 }
 func TestEdit_LeavesNoTemporaryFileBehind(t *testing.T) {
 	dir := newBrain(t)
 	seed(t, dir, "knowledge/n.md", "alpha\n")
 	if _, err := Edit(dir, "knowledge/n.md", "alpha", "beta", ScopeNotes); err != nil {
 		t.Fatal(err)
 	}
 	entries, err := os.ReadDir(filepath.Join(dir, "knowledge"))
 	if err != nil {
 		t.Fatal(err)
 	}
 	for _, e := range entries {
 		if e.Name() != "note.md" && e.Name() != "n.md" {
 			t.Errorf("stray file left in the tree: %q (git add -A would commit it)", e.Name())
 		}
 	}
 }
 func TestEdit_PreservesReadableMode(t *testing.T) {
 	// Other uids write this tree (brain-fix, brain-enrich). os.CreateTemp
 	// yields 0600 and rename preserves it, which would break them silently.
 	dir := newBrain(t)
 	abs := seed(t, dir, "knowledge/n.md", "alpha\n")
 	if _, err := Edit(dir, "knowledge/n.md", "alpha", "beta", ScopeNotes); err != nil {
 		t.Fatal(err)
 	}
 	fi, err := os.Stat(abs)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if fi.Mode().Perm() != 0o644 {
 		t.Errorf("mode = %v, want 0644", fi.Mode().Perm())
 	}
 }
 func TestEdit_RefusesNonUTF8Replacement(t *testing.T) {
 	dir := newBrain(t)
 	seed(t, dir, "knowledge/n.md", "alpha\n")
 	if _, err := Edit(dir, "knowledge/n.md", "alpha", "bad \xff", ScopeNotes); err == nil {
 		t.Fatal("new_str with invalid UTF-8 must be refused, not written")
 	}
 }
@@ -1,201 +0,0 @@
 // Package notes provides containment-checked read and surgical edit of brain
 // notes on the live tree that brain-sync commits from.
 //
 // Everything here is defensive for one reason: brain content is ingested from
 // the outside world, that content reaches a model's context via brain_query /
 // brain_context, and these primitives are callable by that model. A path bug
 // is therefore not a path bug — it is an outside author choosing a file.
 package notes
 import (
 	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
 )
 // Scope is which part of the tree a caller is allowed to touch.
 type Scope int
 const (
 	// ScopeNotes is the model-facing scope: markdown under knowledge/ and
 	// wiki/ only.
 	ScopeNotes Scope = iota
 	// ScopeRoot admits the named governance files and NOTHING else. It exists so
 	// there is an MCP path to CLAUDE.md at all — the absence of one is what
 	// pushed a session to edit via the gitea REST API on 2026-06-16, which
 	// never reached the live tree and wedged brain-sync for hours. It is NOT
 	// reachable from the model-facing toolset; see tools_notes.go.
 	ScopeRoot
 )
 // rootFiles is an exact-name allowlist, deliberately not a "root *.md" glob.
 //
 // Two reasons. log.md is gitignored, so an edit to it applies to the live tree
 // and never reaches gitea — the exact shape of brain#2, admitted by a glob. And
 // a glob auto-admits whatever governance file appears next (AGENTS.md, a
 // bootstrap doc) with nobody reviewing that decision.
 var rootFiles = map[string]bool{"CLAUDE.md": true}
 // noteDirs are the two trees that hold notes.
 var noteDirs = []string{"knowledge/", "wiki/"}
 // deniedPrefixes are refused in every scope, independent of the allowlist.
 //
 // A static backstop rather than a consequence of the allowlist being right:
 // .git/hooks/post-commit is executed by brain-sync inside a pod holding the
 // Gitea push credentials, and archive/ + sessions/ hold verbatim session
 // transcripts that BM25 never indexes and so nobody thinks of as reachable.
 var deniedPrefixes = []string{".git/", "archive/", "sessions/", "raw/", "training-data/", ".obsidian/"}
 // Errors are sentinels so callers can distinguish a refusal from an I/O fault.
 var (
 	ErrOutsideBrain  = errors.New("notes: path escapes the brain dir")
 	ErrNotAllowed    = errors.New("notes: path is not editable through this tool")
 	ErrNotSyncSource = errors.New("notes: brain dir is not the sync source")
 )
 // Target is a resolved, contained path.
 type Target struct {
 	Rel string // brain-relative, cleaned
 	Abs string // absolute, symlink-checked
 }
 // Resolve canonicalises path, then checks it against the scope's allowlist,
 // then re-checks containment after symlink evaluation.
 //
 // Order matters and is the point: a prefix test on the raw argument accepts
 // "knowledge/../.git/hooks/post-commit", because Clean only collapses it
 // afterwards.
 func Resolve(brainDir, path string, scope Scope) (Target, error) {
 	// Note: the sync-source assertion lives on the WRITE path (Edit), not
 	// here. brain#2 was an edit landing where the sync could not commit it; a
 	// read from such a tree is merely a read.
 	// 1. Canonicalise. Rooting at "/" makes Clean collapse every ".." that
 	//    would otherwise escape, and ToSlash normalises separators first.
 	clean := strings.TrimPrefix(filepath.Clean("/"+filepath.ToSlash(path)), "/")
 	if clean == "" || clean == "." {
 		return Target{}, fmt.Errorf("%w: empty path", ErrNotAllowed)
 	}
 	// 2. Static denials, before any allowlist reasoning.
 	for _, d := range deniedPrefixes {
 		if strings.HasPrefix(clean+"/", d) {
 			return Target{}, fmt.Errorf("%w: %q is not note content", ErrNotAllowed, clean)
 		}
 	}
 	if strings.HasPrefix(filepath.Base(clean), ".") {
 		return Target{}, fmt.Errorf("%w: dotfiles are not editable", ErrNotAllowed)
 	}
 	// 3. Scope allowlist.
 	if err := allow(clean, scope); err != nil {
 		return Target{}, err
 	}
 	// 4. Containment, lexically.
 	abs := filepath.Join(brainDir, filepath.FromSlash(clean))
 	if !within(brainDir, abs) {
 		return Target{}, fmt.Errorf("%w: %q", ErrOutsideBrain, path)
 	}
 	// 5. Containment again, after resolving symlinks. The tree is Syncthing
 	//    managed, so a link can appear without anyone adding one on purpose;
 	//    a symlinked note or directory would otherwise read and write outside
 	//    the brain entirely.
 	if err := assertNoSymlinkEscape(brainDir, abs); err != nil {
 		return Target{}, err
 	}
 	return Target{Rel: clean, Abs: abs}, nil
 }
 // allow enforces the scope's allowlist. The two scopes are DISJOINT, not
 // nested: the privileged root scope reaches governance files and nothing else,
 // so the tool that carries the higher privilege carries the smaller reach.
 func allow(clean string, scope Scope) error {
 	if scope == ScopeRoot {
 		if !rootFiles[clean] {
 			return fmt.Errorf("%w: %q is not a governance file", ErrNotAllowed, clean)
 		}
 		return nil
 	}
 	if !isNotePath(clean) {
 		return fmt.Errorf("%w: %q is outside knowledge/ and wiki/", ErrNotAllowed, clean)
 	}
 	return nil
 }
 func isNotePath(clean string) bool {
 	var inDir bool
 	for _, d := range noteDirs {
 		if strings.HasPrefix(clean, d) {
 			inDir = true
 			break
 		}
 	}
 	if !inDir || filepath.Ext(clean) != ".md" {
 		return false
 	}
 	// _index.md is generated per wing, and brain-sync's conflict resolver
 	// deliberately resolves it in origin's favour — an edit here is reverted
 	// by design, so accepting one would be a lie.
 	return filepath.Base(clean) != "_index.md"
 }
 func within(root, abs string) bool {
 	rel, err := filepath.Rel(root, abs)
 	if err != nil {
 		return false
 	}
 	return rel != ".." && !strings.HasPrefix(rel, ".."+string(filepath.Separator))
 }
 // assertNoSymlinkEscape resolves the deepest existing ancestor of abs and
 // requires it to still be inside brainDir. The file itself need not exist
 // (a create is legal); its directory chain must be real and contained.
 func assertNoSymlinkEscape(brainDir, abs string) error {
 	if fi, err := os.Lstat(abs); err == nil && fi.Mode()&os.ModeSymlink != 0 {
 		return fmt.Errorf("%w: %q is a symlink", ErrNotAllowed, abs)
 	}
 	realRoot, err := filepath.EvalSymlinks(brainDir)
 	if err != nil {
 		return fmt.Errorf("notes: resolve brain dir: %w", err)
 	}
 	dir := filepath.Dir(abs)
 	for {
 		resolved, err := filepath.EvalSymlinks(dir)
 		if err == nil {
 			if !within(realRoot, resolved) {
 				return fmt.Errorf("%w: %q resolves outside the brain dir", ErrOutsideBrain, dir)
 			}
 			return nil
 		}
 		if !os.IsNotExist(err) {
 			return fmt.Errorf("notes: resolve %q: %w", dir, err)
 		}
 		parent := filepath.Dir(dir)
 		if parent == dir {
 			return fmt.Errorf("%w: no existing ancestor for %q", ErrOutsideBrain, abs)
 		}
 		dir = parent
 	}
 }
 // assertSyncSource refuses a brain dir that is not a git working tree.
 //
 // brain#2 was an edit landing on a directory the sync does not commit from.
 // That cannot be prevented by review — a wrong INGEST_BRAIN_DIR in a future
 // manifest reintroduces it while every unit test still passes — so it is
 // asserted at runtime, the same check brain-sync itself makes before running.
 func assertSyncSource(brainDir string) error {
 	if fi, err := os.Stat(filepath.Join(brainDir, ".git")); err != nil || !fi.IsDir() {
 		return fmt.Errorf("%w: %q has no .git, so an edit there would never be committed",
 			ErrNotSyncSource, brainDir)
 	}
 	return nil
 }
@@ -1,146 +0,0 @@
 package notes
 import (
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 )
 // newBrain lays out a tree shaped like the live one: a git dir, note dirs,
 // and the non-note areas that must never be reachable.
 func newBrain(t *testing.T) string {
 	t.Helper()
 	dir := t.TempDir()
 	for _, d := range []string{
 		".git/hooks", "knowledge", "wiki/homelab/facts", "archive/claude-sessions/koala",
 		"sessions", "raw", ".obsidian",
 	} {
 		if err := os.MkdirAll(filepath.Join(dir, d), 0o755); err != nil {
 			t.Fatal(err)
 		}
 	}
 	write := func(p, s string) {
 		t.Helper()
 		if err := os.WriteFile(filepath.Join(dir, p), []byte(s), 0o644); err != nil {
 			t.Fatal(err)
 		}
 	}
 	write("CLAUDE.md", "# instructions\n")
 	write("log.md", "ignored scratch\n")
 	write("knowledge/note.md", "# note\n")
 	write("wiki/homelab/facts/f.md", "# fact\n")
 	write("wiki/homelab/_index.md", "# index\n")
 	write("archive/claude-sessions/koala/session-1.md", "verbatim transcript\n")
 	write("sessions/s.jsonl", "{}\n")
 	write(".git/hooks/post-commit", "#!/bin/sh\n")
 	return dir
 }
 func TestResolve_AcceptsNotePaths(t *testing.T) {
 	dir := newBrain(t)
 	for _, p := range []string{"knowledge/note.md", "wiki/homelab/facts/f.md"} {
 		got, err := Resolve(dir, p, ScopeNotes)
 		if err != nil {
 			t.Errorf("Resolve(%q): %v", p, err)
 			continue
 		}
 		if !strings.HasPrefix(got.Abs, dir) {
 			t.Errorf("Resolve(%q).Abs = %q, want inside %q", p, got.Abs, dir)
 		}
 	}
 }
 func TestResolve_RefusesEscapesAndNonNoteAreas(t *testing.T) {
 	dir := newBrain(t)
 	// Canonicalisation must happen BEFORE the allowlist check. A prefix test
 	// on the raw argument accepts every one of these: "knowledge/..%2f" style
 	// inputs collapse to .git, and .git/hooks/post-commit is executed by
 	// brain-sync inside a pod holding the Gitea push credentials.
 	refuse := []string{
 		"knowledge/../.git/hooks/post-commit",
 		"wiki/../.git/config",
 		"./knowledge/../.git/config",
 		"knowledge//../.git/config",
 		"../../etc/passwd",
 		"/etc/passwd",
 		".git/config",
 		"archive/claude-sessions/koala/session-1.md", // verbatim transcripts
 		"sessions/s.jsonl",
 		"raw/x.md",
 		".obsidian/workspace.json",
 		"log.md",                 // gitignored: an edit here would never sync (brain#2)
 		"wiki/homelab/_index.md", // generated; brain-sync resolves it in origin's favour
 		"knowledge/note.txt",     // not markdown
 		"CLAUDE.md",              // root file — not reachable in the notes scope
 	}
 	for _, p := range refuse {
 		if _, err := Resolve(dir, p, ScopeNotes); err == nil {
 			t.Errorf("Resolve(%q) = nil error, want refusal", p)
 		}
 	}
 }
 func TestResolve_RootScopeAdmitsOnlyNamedFiles(t *testing.T) {
 	dir := newBrain(t)
 	if _, err := Resolve(dir, "CLAUDE.md", ScopeRoot); err != nil {
 		t.Errorf("Resolve(CLAUDE.md, ScopeRoot): %v", err)
 	}
 	// log.md is the reason this is an exact-name list and not "root *.md":
 	// it is gitignored, so an edit would apply locally and never reach gitea.
 	for _, p := range []string{"log.md", "AGENTS.md", "knowledge/note.md", ".git/config"} {
 		if _, err := Resolve(dir, p, ScopeRoot); err == nil {
 			t.Errorf("Resolve(%q, ScopeRoot) = nil error, want refusal", p)
 		}
 	}
 }
 func TestResolve_RefusesSymlinkedTargets(t *testing.T) {
 	dir := newBrain(t)
 	outside := filepath.Join(t.TempDir(), "secret.md")
 	if err := os.WriteFile(outside, []byte("secret\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	// The tree is Syncthing-managed, so a symlink can appear without anyone
 	// adding one deliberately. Containment must survive it.
 	if err := os.Symlink(outside, filepath.Join(dir, "knowledge/link.md")); err != nil {
 		t.Skipf("symlinks unavailable: %v", err)
 	}
 	if _, err := Resolve(dir, "knowledge/link.md", ScopeNotes); err == nil {
 		t.Error("Resolve followed a symlink out of the brain dir")
 	}
 	if err := os.Symlink(filepath.Dir(outside), filepath.Join(dir, "wiki/escape")); err != nil {
 		t.Skipf("symlinks unavailable: %v", err)
 	}
 	if _, err := Resolve(dir, "wiki/escape/secret.md", ScopeNotes); err == nil {
 		t.Error("Resolve followed a symlinked directory out of the brain dir")
 	}
 }
 func TestResolve_RefusesWhenTheTreeIsNotTheSyncSource(t *testing.T) {
 	// brain#2 was "wrote to a directory the sync does not commit from". No
 	// code review prevents that recurring — a wrong INGEST_BRAIN_DIR in a
 	// future manifest reintroduces it and every unit test still passes. So
 	// assert the property at runtime, the way brain-sync itself does.
 	dir := t.TempDir()
 	if err := os.MkdirAll(filepath.Join(dir, "knowledge"), 0o755); err != nil {
 		t.Fatal(err)
 	}
 	if err := os.WriteFile(filepath.Join(dir, "knowledge/note.md"), []byte("x"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	// Reads are fine anywhere; the guard belongs to writes.
 	if _, err := Resolve(dir, "knowledge/note.md", ScopeNotes); err != nil {
 		t.Fatalf("Resolve should not require .git for a read: %v", err)
 	}
 	_, err := Edit(dir, "knowledge/note.md", "x", "y", ScopeNotes)
 	if err == nil {
 		t.Fatal("Edit accepted a tree with no .git — the write would never be committed")
 	}
 	if !strings.Contains(err.Error(), "sync source") {
 		t.Errorf("error should name the cause, got %v", err)
 	}
 }
@@ -3,7 +3,6 @@ package pipeline
 import (
 	"fmt"
 	"regexp"
 	"strings"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/wiki"
@@ -17,12 +16,6 @@ func BuildPages(rawPages []RawPage, sourceSlug, date string) ([]wiki.Page, []str
 	out := make([]wiki.Page, 0, len(rawPages))
 	var warnings []string
 	for _, rp := range rawPages {
 		// The type becomes a directory under wiki/; "../raw" wrote outside it
 		// (PR #147 review). Only a plain lower-case name is a page type.
 		if !validPageType.MatchString(rp.Type) {
 			warnings = append(warnings, fmt.Sprintf("skipped page with invalid type %q", rp.Type))
 			continue
 		}
 		slug := computeSlug(rp, sourceSlug)
 		if slug == "" {
 			warnings = append(warnings, fmt.Sprintf("skipped page with empty title (type: %s)", rp.Type))
@@ -33,8 +26,6 @@ func BuildPages(rawPages []RawPage, sourceSlug, date string) ([]wiki.Page, []str
 	return out, warnings
 }
 var validPageType = regexp.MustCompile(`^[a-z][a-z0-9-]*$`)
 func computeSlug(rp RawPage, sourceSlug string) string {
 	if rp.Type == "source" {
 		return sourceSlug
@@ -85,9 +76,6 @@ func buildFrontmatter(rp RawPage, date string) string {
 		}
 		fmt.Fprintf(&sb, "date_ingested: %s\n", date)
 		fmt.Fprintf(&sb, "last_updated: %s\n", date)
 		if rp.SourceHash != "" {
 			fmt.Fprintf(&sb, "source_hash: %s\n", rp.SourceHash)
 		}
 		if rp.Source != "" {
 			fmt.Fprintf(&sb, "source: %s\n", yamlScalar(rp.Source))
 		}
@@ -123,9 +111,5 @@ func buildFrontmatter(rp RawPage, date string) string {
 }
 func yamlScalar(s string) string {
 	// A raw newline or CR would end the scalar for every line-oriented
 	// frontmatter reader and start a new key (PR #147 review: a title of
 	// "x\norigin: static" forged provenance). Fold all line breaks to spaces.
 	s = strings.NewReplacer("\r\n", " ", "\r", " ", "\n", " ").Replace(s)
 	return "'" + strings.ReplaceAll(s, "'", "''") + "'"
 }
@@ -20,10 +20,6 @@ type RawPage struct {
 	// ingested content's own frontmatter (see parseContentFrontmatter) — never
 	// set by the LLM. json:"-" keeps them immune to same-named keys the LLM
 	// might emit. Only meaningful for Type == "source".
 	// SourceHash is sha256 of the ingested BODY (frontmatter excluded), stamped
 	// so the next ingest of the same source can tell "unchanged" from "edited"
 	// without re-running extraction (#105).
 	SourceHash string `json:"-"`
 	Source    string `json:"-"`
 	Author    string `json:"-"`
 	Published string `json:"-"`
@@ -116,11 +112,6 @@ type sourceMeta struct {
 	Source    string
 	Author    string
 	Published string
 	// BodyHash is sha256 of the content with any leading frontmatter removed.
 	// Body-only on purpose: a re-crawl that stamps a new fetch date has not
 	// changed the source, and treating that as drift would re-extract the
 	// whole corpus every time a crawler ran (#105).
 	BodyHash string
 }
 // parseContentFrontmatter extracts source/author/published from a leading
@@ -163,7 +154,6 @@ func applySourceMeta(pages []RawPage, meta sourceMeta) {
 		if pages[i].Type != "source" {
 			continue
 		}
 		pages[i].SourceHash = meta.BodyHash
 		pages[i].Source = meta.Source
 		pages[i].Author = meta.Author
 		pages[i].Published = meta.Published
--- a/Show More
+++ b/Show More
		`@@ -1,2 +0,0 @@`
			`# Presence of this file marks this repo as opt-in for headless dispatch.`
			`# See dispatch#3.`
`@@ -1 +1,2 @@`
	`ingestion: cd ingestion && INGEST_BRAIN_DIR=../brain INGEST_PORT=3300 INGEST_WATCH_INTERVAL=30 go run ./cmd/server/`	`ingestion: cd ingestion && INGEST_BRAIN_DIR=../brain INGEST_PORT=3300 INGEST_WATCH_INTERVAL=30 go run ./cmd/server/`
		`supervisor: SUPERVISOR_CONFIG_DIR=./config/supervisor SUPERVISOR_MODELS_FILE=./config/models.yaml SUPERVISOR_SESSIONS_DIR=./brain/sessions INGEST_BASE_URL=http://localhost:3300 INGEST_SVC_URL=http://localhost:3300 go run ./cmd/supervisor/`