test(watcher): a marker link planted during the run is refused and not retried (#158)

Review round 2 on PR #195: the marker writes had no test, so reverting
them to by-path writes, or the refusal to log-only, stayed green. The
link is planted from inside the fake model call, between the walk's
Lstat and the marker write, for both markers and both an outside and
an in-brain relative target; red on all four flips. The marker-entry
skip is now checked for .failed too.

Also pins cleanRel's acceptance of a backslash as a filename byte in
brainfs itself, and stops the buildAndWrite control claiming writes it
does not count.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.context/PROJECT.md

@@ -84,15 +84,3 @@ When acting as a coding agent on this project:
 4. Never modify files outside the project root without explicit permission
 5. When adding a dependency, explain why in the commit message
 6. For client projects: never send code or context to cloud APIs — use local models via LiteLLM
-
-## `main` is protected: ship by PR (local-dev#42, decided 2026-10-08)
-
-Gitea refuses direct pushes to `main` in this repo, and a PR merges only after its CI status (`CI / Lint / Test / Vet (pull_request)`) passes.
-**Why:** local-dev rule 5's reviewed lane (risk/medium+ is reviewed by a human) was enforced on the merge tools
-(`tbd_ship`, `pr_merge`: gitea-mcp v0.17.0/v0.18.0, merge only for an issue labelled exactly `risk/low` with green CI)
-but not on a direct commit to `main`, which bypassed it. This overrides rule 5's "risk/low commits straight to main"
-for this repo; control code is where the lane matters.
-**How:** `tbd_ship` for a one-file change, or branch -> PR -> `pr_merge` (name the `risk/low` issue); above `risk/low`
-open the PR and a human merges it in the Gitea UI after review. Tags are not protected. CD jobs push image tags to
-the **infra** repo with deploy keys, never to this repo's `main`. Undo (Mathias only): Settings -> Branches, or
-`PATCH /repos/mathias/hyperguild/branch_protections/main {"enable_push": true}`.

.context/system-prompt.txt

@@ -164,63 +164,6 @@ These rules apply to every task across every project, regardless of harness.
    the thing it was named for was exploitable. If you cannot name the mechanism,
    you do not yet know what the test observes.
 
-10. **Short sessions, one rc per repo, edit only in a locked worktree of the repo
-   you are changing** (ADR-0002, accepted 2026-10-06).
-   - One session per issue or task, ending with rule 6's close ritual. Related
-     issues may share a session only when they share a worktree and an owner.
-     State that must outlive the session goes in an issue, not the chat.
-   - Start `claude rc` in the repo you will edit (`infra`, `trucker-ecommerce`,
-     `hyperguild`, ...), not in `~/dev`: the rc worktree is a worktree of the
-     launch directory's repo, so launched from `~/dev` it protects nothing you
-     edit (measured: 73% of edits landed in shared checkouts). Start it only
-     while working there.
-   - Keep at most one thin `~/dev` coordinator session. It files issues and hands
-     out tasks; it reads and edits no sub-repo code.
-   - Split cross-repo work per repo. The contract between the halves lives in an
-     issue on each repo.
-   - Edit in a worktree of that repo, locked at creation:
-     `scripts/wt.sh add <repo> <task>` does it (fetch, `wt/<task>` from origin/main, lock);
-     `scripts/wt.sh done <repo>-<task>` removes it after the push and refuses dirty or
-     unpushed work. By hand: `git worktree add ~/worktrees/<name> -b <branch> origin/main`
-     then `git worktree lock --reason "manual: <purpose>" ~/worktrees/<name>`.
-   - Before working a repo another session may touch, announce your issue list to
-     that session (`SendMessage`) and ask for theirs.
-   - Auto-memory is keyed by cwd, so a repo rc starts without it. Cross-repo
-     working rules live in brain (`wiki/homelab/decisions/2026-10-06-062416-auto.md`, wing homelab, hall
-     decisions) and the section below, not in per-directory memory.
-
-## Standing footguns
-
-Each cost real time once. Detail and evidence: brain `wiki/homelab/decisions/2026-10-06-062416-auto.md` (title standing-working-rules).
-
-- **Gate then commit with `&&`, never `;`.** "Green" means exit code 0 and
-  `grep -c FAIL` is 0, not a filtered grep.
-- **Stage by path, never `git add -A` or `git add .`** (they stage from the repo
-  root and swept in other sessions' work twice). Check `git status --porcelain` first.
-- **Before committing in a shared checkout:** `git branch --show-current`.
-- **Before tagging:** `git fetch origin --tags`, then `git describe --tags --abbrev=0 <sha>`
-  and `git tag --sort=-v:refname | head`; go above both. Never take the last tag
-  from a report.
-- **Run only what the project's gate runs.** No repo-wide formatter unless the gate
-  runs it.
-- **Reproduce a CI red at the cited commit before applying an issue's prescribed fix.**
-- **Read an issue's comments (`issue_list_comments`), not just its body, before working it.**
-- **A comment naming a control ("behind branch protection") is not evidence; query
-  the control.** A working detector can hide a missing preventer.
-- **On koala the MCP servers are `mcp__plugin_skills_{brain,gitea,infra}__*`.** The
-  per-turn auth reminder is not evidence; call the tool or run `claude mcp list`.
-  Brain writes always pass `wing` + `hall`.
-- **`cat /etc/hostname` before assuming which host you are on.**
-- **Never run bare `git remote -v` or `git config --list`** (url.insteadOf expands
-  into a live token); use `git config --get remote.origin.url`.
-- **On koala `sudo` is denied outright; k8s exec, env dumps and flux reconcile need
-  per-action approval; decrypting a SOPS file and printing in one Bash call is
-  hook-blocked.** Do the repo-side work and hand the host-side step over in an issue.
-- **`set -o pipefail` plus an optional `grep | head | awk` dies on no match:** append `|| true`.
-- **Gitea `file_write_branch` takes plain text, not base64.**
-- **`OP_SERVICE_ACCOUNT_TOKEN` in the shell is read-only for `op`.** Operational
-  secrets go in the AgentSecrets vault via `set -a; . ~/.op-agent-write.env; set +a`.
-
 ## CAD sprint patterns
 
 Two CAD sprint archetypes (defs: brain `wiki/homelab/decisions/continuous-agentic-development-cad-concept-2026-06-16`):
@@ -301,20 +244,25 @@ Three machines on Tailscale:
 
 All development repos live at `~/dev/` (softlink from `~/Documents/local-dev/`).
 
-Organized by **role**, because the role decides which rules apply (ADR-0003):
+Organized in thematic folders:
 
-| Folder | Role | Rules that key off it |
+| Folder | Focus | Count |
-|--------|------|-----------------------|
+|--------|-------|-------|
-| `platform/` | infra, brain, hyperguild, gitea-mcp, dispatch, shared tooling | control code (rule 8), GitOps review lane |
+| `GO/` | Go web frameworks, API integrations, learning projects | ~10 |
-| `products/` | tapir, cobalt-dingo, openbanking-api, ... | ordinary trunk-based work |
+| `AI/` | ML research, AI frameworks (FinRL, DSPy, crawl4ai) | ~6 |
-| `clients/` | client work | local models only, never cloud APIs (Client work rules) |
+| `AGENTS/` | Autonomous agents, coding agents, MCP servers, infra | ~15 |
-| `spikes/` | throwaway | no ceremony |
+| `QKX/` | Invoice processing, financial automation, payment systems | ~13 |
+| `XT/` | Climate data, sustainability (Klimatkollen, Garbo) | ~2 |
 
-New projects are born into a role folder (`task new-project -- <name> <client|personal>
+See `~/dev/PROJECT_SUMMARY.md` for detailed descriptions of each project.
-<role-folder>`); a client tag requires `clients/` and `clients/` requires a client tag.
+
-Existing repos still sit in the old `AGENTS/` and `AI/` folders until they are moved one by
+### Key active projects
-one (ADR-0003 step 3). `~/dev/PROJECT_SUMMARY.md` (generated) lists every repo and where it
+
-is. How a session runs on koala (worktrees, rc per repo, the reaper, memory): `docs/working-on-koala.md`.
+- **super-koala** (`AGENTS/`) — multi-component agent stack with LangGraph, DSPy, MCP
+- **azure-tiger** (`QKX/`) — invoice extraction → ISO 20022 payment instructions
+- **gocrwl** (`AGENTS/`) — Go web crawler with containerized deployment
+- **koala-ai-stack** (`AGENTS/`) — local AI server infrastructure management
+- **klimatkollen** (`XT/`) — Swedish municipal climate data platform
 
 ## Knowledge base — actively use it
 
@@ -566,16 +514,4 @@ When acting as a coding agent on this project:
 5. When adding a dependency, explain why in the commit message
 6. For client projects: never send code or context to cloud APIs — use local models via LiteLLM
 
-## `main` is protected: ship by PR (local-dev#42, decided 2026-10-08)
-
-Gitea refuses direct pushes to `main` in this repo, and a PR merges only after its CI status (`CI / Lint / Test / Vet (pull_request)`) passes.
-**Why:** local-dev rule 5's reviewed lane (risk/medium+ is reviewed by a human) was enforced on the merge tools
-(`tbd_ship`, `pr_merge`: gitea-mcp v0.17.0/v0.18.0, merge only for an issue labelled exactly `risk/low` with green CI)
-but not on a direct commit to `main`, which bypassed it. This overrides rule 5's "risk/low commits straight to main"
-for this repo; control code is where the lane matters.
-**How:** `tbd_ship` for a one-file change, or branch -> PR -> `pr_merge` (name the `risk/low` issue); above `risk/low`
-open the PR and a human merges it in the Gitea UI after review. Tags are not protected. CD jobs push image tags to
-the **infra** repo with deploy keys, never to this repo's `main`. Undo (Mathias only): Settings -> Branches, or
-`PATCH /repos/mathias/hyperguild/branch_protections/main {"enable_push": true}`.
-
 ---

AGENTS.md

@@ -159,63 +159,6 @@ These rules apply to every task across every project, regardless of harness.
    the thing it was named for was exploitable. If you cannot name the mechanism,
    you do not yet know what the test observes.
 
-10. **Short sessions, one rc per repo, edit only in a locked worktree of the repo
-   you are changing** (ADR-0002, accepted 2026-10-06).
-   - One session per issue or task, ending with rule 6's close ritual. Related
-     issues may share a session only when they share a worktree and an owner.
-     State that must outlive the session goes in an issue, not the chat.
-   - Start `claude rc` in the repo you will edit (`infra`, `trucker-ecommerce`,
-     `hyperguild`, ...), not in `~/dev`: the rc worktree is a worktree of the
-     launch directory's repo, so launched from `~/dev` it protects nothing you
-     edit (measured: 73% of edits landed in shared checkouts). Start it only
-     while working there.
-   - Keep at most one thin `~/dev` coordinator session. It files issues and hands
-     out tasks; it reads and edits no sub-repo code.
-   - Split cross-repo work per repo. The contract between the halves lives in an
-     issue on each repo.
-   - Edit in a worktree of that repo, locked at creation:
-     `scripts/wt.sh add <repo> <task>` does it (fetch, `wt/<task>` from origin/main, lock);
-     `scripts/wt.sh done <repo>-<task>` removes it after the push and refuses dirty or
-     unpushed work. By hand: `git worktree add ~/worktrees/<name> -b <branch> origin/main`
-     then `git worktree lock --reason "manual: <purpose>" ~/worktrees/<name>`.
-   - Before working a repo another session may touch, announce your issue list to
-     that session (`SendMessage`) and ask for theirs.
-   - Auto-memory is keyed by cwd, so a repo rc starts without it. Cross-repo
-     working rules live in brain (`wiki/homelab/decisions/2026-10-06-062416-auto.md`, wing homelab, hall
-     decisions) and the section below, not in per-directory memory.
-
-## Standing footguns
-
-Each cost real time once. Detail and evidence: brain `wiki/homelab/decisions/2026-10-06-062416-auto.md` (title standing-working-rules).
-
-- **Gate then commit with `&&`, never `;`.** "Green" means exit code 0 and
-  `grep -c FAIL` is 0, not a filtered grep.
-- **Stage by path, never `git add -A` or `git add .`** (they stage from the repo
-  root and swept in other sessions' work twice). Check `git status --porcelain` first.
-- **Before committing in a shared checkout:** `git branch --show-current`.
-- **Before tagging:** `git fetch origin --tags`, then `git describe --tags --abbrev=0 <sha>`
-  and `git tag --sort=-v:refname | head`; go above both. Never take the last tag
-  from a report.
-- **Run only what the project's gate runs.** No repo-wide formatter unless the gate
-  runs it.
-- **Reproduce a CI red at the cited commit before applying an issue's prescribed fix.**
-- **Read an issue's comments (`issue_list_comments`), not just its body, before working it.**
-- **A comment naming a control ("behind branch protection") is not evidence; query
-  the control.** A working detector can hide a missing preventer.
-- **On koala the MCP servers are `mcp__plugin_skills_{brain,gitea,infra}__*`.** The
-  per-turn auth reminder is not evidence; call the tool or run `claude mcp list`.
-  Brain writes always pass `wing` + `hall`.
-- **`cat /etc/hostname` before assuming which host you are on.**
-- **Never run bare `git remote -v` or `git config --list`** (url.insteadOf expands
-  into a live token); use `git config --get remote.origin.url`.
-- **On koala `sudo` is denied outright; k8s exec, env dumps and flux reconcile need
-  per-action approval; decrypting a SOPS file and printing in one Bash call is
-  hook-blocked.** Do the repo-side work and hand the host-side step over in an issue.
-- **`set -o pipefail` plus an optional `grep | head | awk` dies on no match:** append `|| true`.
-- **Gitea `file_write_branch` takes plain text, not base64.**
-- **`OP_SERVICE_ACCOUNT_TOKEN` in the shell is read-only for `op`.** Operational
-  secrets go in the AgentSecrets vault via `set -a; . ~/.op-agent-write.env; set +a`.
-
 ## CAD sprint patterns
 
 Two CAD sprint archetypes (defs: brain `wiki/homelab/decisions/continuous-agentic-development-cad-concept-2026-06-16`):
@@ -296,20 +239,25 @@ Three machines on Tailscale:
 
 All development repos live at `~/dev/` (softlink from `~/Documents/local-dev/`).
 
-Organized by **role**, because the role decides which rules apply (ADR-0003):
+Organized in thematic folders:
 
-| Folder | Role | Rules that key off it |
+| Folder | Focus | Count |
-|--------|------|-----------------------|
+|--------|-------|-------|
-| `platform/` | infra, brain, hyperguild, gitea-mcp, dispatch, shared tooling | control code (rule 8), GitOps review lane |
+| `GO/` | Go web frameworks, API integrations, learning projects | ~10 |
-| `products/` | tapir, cobalt-dingo, openbanking-api, ... | ordinary trunk-based work |
+| `AI/` | ML research, AI frameworks (FinRL, DSPy, crawl4ai) | ~6 |
-| `clients/` | client work | local models only, never cloud APIs (Client work rules) |
+| `AGENTS/` | Autonomous agents, coding agents, MCP servers, infra | ~15 |
-| `spikes/` | throwaway | no ceremony |
+| `QKX/` | Invoice processing, financial automation, payment systems | ~13 |
+| `XT/` | Climate data, sustainability (Klimatkollen, Garbo) | ~2 |
 
-New projects are born into a role folder (`task new-project -- <name> <client|personal>
+See `~/dev/PROJECT_SUMMARY.md` for detailed descriptions of each project.
-<role-folder>`); a client tag requires `clients/` and `clients/` requires a client tag.
+
-Existing repos still sit in the old `AGENTS/` and `AI/` folders until they are moved one by
+### Key active projects
-one (ADR-0003 step 3). `~/dev/PROJECT_SUMMARY.md` (generated) lists every repo and where it
+
-is. How a session runs on koala (worktrees, rc per repo, the reaper, memory): `docs/working-on-koala.md`.
+- **super-koala** (`AGENTS/`) — multi-component agent stack with LangGraph, DSPy, MCP
+- **azure-tiger** (`QKX/`) — invoice extraction → ISO 20022 payment instructions
+- **gocrwl** (`AGENTS/`) — Go web crawler with containerized deployment
+- **koala-ai-stack** (`AGENTS/`) — local AI server infrastructure management
+- **klimatkollen** (`XT/`) — Swedish municipal climate data platform
 
 ## Knowledge base — actively use it
 
@@ -560,15 +508,3 @@ When acting as a coding agent on this project:
 4. Never modify files outside the project root without explicit permission
 5. When adding a dependency, explain why in the commit message
 6. For client projects: never send code or context to cloud APIs — use local models via LiteLLM
-
-## `main` is protected: ship by PR (local-dev#42, decided 2026-10-08)
-
-Gitea refuses direct pushes to `main` in this repo, and a PR merges only after its CI status (`CI / Lint / Test / Vet (pull_request)`) passes.
-**Why:** local-dev rule 5's reviewed lane (risk/medium+ is reviewed by a human) was enforced on the merge tools
-(`tbd_ship`, `pr_merge`: gitea-mcp v0.17.0/v0.18.0, merge only for an issue labelled exactly `risk/low` with green CI)
-but not on a direct commit to `main`, which bypassed it. This overrides rule 5's "risk/low commits straight to main"
-for this repo; control code is where the lane matters.
-**How:** `tbd_ship` for a one-file change, or branch -> PR -> `pr_merge` (name the `risk/low` issue); above `risk/low`
-open the PR and a human merges it in the Gitea UI after review. Tags are not protected. CD jobs push image tags to
-the **infra** repo with deploy keys, never to this repo's `main`. Undo (Mathias only): Settings -> Branches, or
-`PATCH /repos/mathias/hyperguild/branch_protections/main {"enable_push": true}`.

CLAUDE.md

@@ -84,15 +84,3 @@ When acting as a coding agent on this project:
 4. Never modify files outside the project root without explicit permission
 5. When adding a dependency, explain why in the commit message
 6. For client projects: never send code or context to cloud APIs — use local models via LiteLLM
-
-## `main` is protected: ship by PR (local-dev#42, decided 2026-10-08)
-
-Gitea refuses direct pushes to `main` in this repo, and a PR merges only after its CI status (`CI / Lint / Test / Vet (pull_request)`) passes.
-**Why:** local-dev rule 5's reviewed lane (risk/medium+ is reviewed by a human) was enforced on the merge tools
-(`tbd_ship`, `pr_merge`: gitea-mcp v0.17.0/v0.18.0, merge only for an issue labelled exactly `risk/low` with green CI)
-but not on a direct commit to `main`, which bypassed it. This overrides rule 5's "risk/low commits straight to main"
-for this repo; control code is where the lane matters.
-**How:** `tbd_ship` for a one-file change, or branch -> PR -> `pr_merge` (name the `risk/low` issue); above `risk/low`
-open the PR and a human merges it in the Gitea UI after review. Tags are not protected. CD jobs push image tags to
-the **infra** repo with deploy keys, never to this repo's `main`. Undo (Mathias only): Settings -> Branches, or
-`PATCH /repos/mathias/hyperguild/branch_protections/main {"enable_push": true}`.

ingestion/cmd/server/main.go

@@ -17,6 +17,7 @@ import (
 
 	"github.com/mathiasbq/hyperguild/ingestion/internal/api"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/audit"
+	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/capture"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/capturehttp"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/classification"
@@ -89,11 +90,15 @@ func (s *claudeSink) Ingest(ctx context.Context, b claudewatcher.Batch) error {
 		sb.WriteString("\n\n")
 	}
 	slug := "session-" + b.Host + "-" + b.SessionID
-	dest := filepath.Join(s.brainDir, "archive", "claude-sessions", b.Host, slug+".md")
+	dest := "archive/claude-sessions/" + b.Host + "/" + slug + ".md"
-	if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
+	// Written through the brain root, never through a symlinked directory
-		return fmt.Errorf("create claude-sessions archive dir: %w", err)
+	// or file (hyperguild#158).
+	bfs, err := brainfs.Open(s.brainDir)
+	if err != nil {
+		return fmt.Errorf("open brain: %w", err)
 	}
-	if err := os.WriteFile(dest, []byte(sb.String()), 0o644); err != nil {
+	defer func() { _ = bfs.Close() }()
+	if err := bfs.PutRegular(dest, []byte(sb.String())); err != nil {
 		return fmt.Errorf("write claude session archive: %w", err)
 	}
 	s.logger.Debug("claude session archived (non-indexed)", "path", dest)
@@ -179,12 +184,9 @@ func alertingWarnings(getenv func(string) string) []string {
 	return out
 }
 
-// buildNotifier returns the ntfy notifier for one alert source, titled so
+func buildNotifier() audit.Notifier {
-// the source is recognisable (hyperguild#163), or nil when ntfy is not
+	if n := audit.NewNtfyNotifier(os.Getenv("BRAIN_NTFY_URL"), os.Getenv("BRAIN_NTFY_TOKEN")); n != nil {
-// configured.
+		return n
-func buildNotifier(getenv func(string) string, title string) audit.Notifier {
-	if n := audit.NewNtfyNotifier(getenv("BRAIN_NTFY_URL"), getenv("BRAIN_NTFY_TOKEN")); n != nil {
-		return n.WithTitle(title)
 	}
 	return nil
 }
@@ -206,7 +208,7 @@ func buildAuditSink(ctx context.Context, brainDir string, logger *slog.Logger) c
 		logger.Error("capture audit buffer init", "err", err)
 		os.Exit(1)
 	}
-	notifier := buildNotifier(os.Getenv, "brain-capture audit degraded")
+	notifier := buildNotifier()
 	reconcileInterval := time.Duration(envInt("BRAIN_AUDIT_RECONCILE_INTERVAL", 60)) * time.Second
 	audit.StartReconcile(ctx, central, buffer, notifier, reconcileInterval)
 	logger.Info("capture audit: loki+buffer sink", "loki", lokiURL, "reconcile_s", int(reconcileInterval.Seconds()))
@@ -369,7 +371,7 @@ func main() {
 
 	ctx := context.Background()
 	// hyperguild#157: report a symlink that appears in the brain while running.
-	go symlinkguard.Watch(ctx, brainDir, symlinkScanInterval(os.Getenv), buildNotifier(os.Getenv, "brain symlink tripwire"))
+	go symlinkguard.Watch(ctx, brainDir, symlinkScanInterval(os.Getenv), buildNotifier())
 
 	// Never fatal on an unreachable issuer (#83): on a cold cluster boot this
 	// pod can beat dex to serving and get a 502 from ingress, and exiting meant
@@ -549,7 +551,7 @@ func main() {
 		// capture already gets, plus an out-of-band alert. Wired here because
 		// brain_edit_root needs the capture plumbing anyway — that is what
 		// re-derives the static principal its gate checks.
-		mcpSrv.WithGovernanceObserver(auditSink, buildNotifier(os.Getenv, "brain governance edit"))
+		mcpSrv.WithGovernanceObserver(auditSink, buildNotifier())
 		logger.Info("capture enabled (REST + MCP tool)", "sovereign_principals", len(sovereign),
 			"governance_observer", true)
 	} else {

ingestion/cmd/server/main_test.go

@@ -76,3 +76,27 @@ func TestAlertingWarnings(t *testing.T) {
 		})
 	}
 }
+
+// hyperguild#158: the claude-session archive was written with os.MkdirAll +
+// os.WriteFile by path, so a symlinked archive directory redirected it.
+func TestClaudeSinkDoesNotWriteThroughASymlinkedArchiveDir(t *testing.T) {
+	for name, mk := range map[string]func(t *testing.T, dir string) (link, target string){
+		"outside": func(t *testing.T, _ string) (string, string) { o := t.TempDir(); return o, o },
+		"in-brain": func(t *testing.T, dir string) (string, string) {
+			require.NoError(t, os.MkdirAll(filepath.Join(dir, "raw"), 0o755))
+			return filepath.Join("..", "raw"), filepath.Join(dir, "raw")
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			dir := t.TempDir()
+			link, target := mk(t, dir)
+			require.NoError(t, os.Symlink(link, filepath.Join(dir, "archive")))
+			sink := &claudeSink{brainDir: dir, logger: slog.New(slog.NewTextHandler(os.Stderr, nil))}
+			err := sink.Ingest(context.Background(), claudewatcher.Batch{Host: "koala", SessionID: "abc",
+				Turns: []claudewatcher.Turn{{Type: "assistant", Content: "x"}}})
+			assert.Error(t, err)
+			ents, _ := os.ReadDir(target)
+			assert.Empty(t, ents, "the archive was written at the link's target")
+		})
+	}
+}

ingestion/cmd/server/routes_test.go

@@ -159,16 +159,3 @@ func TestBuildMuxObservesRequestsAndServesMetrics(t *testing.T) {
 	require.Equal(t, http.StatusOK, code)
 	assert.Contains(t, body, `path="GET /pending"`)
 }
-
-// hyperguild#185: an authenticated request to an unregistered path reached
-// the inner REST mux, which left Pattern empty, and the metrics label fell
-// back to the raw URL path: one Prometheus series per unique path any token
-// holder sends. It is now labelled with a fixed catch-all.
-func TestBuildMuxLabelsAnUnregisteredPathWithAFixedLabel(t *testing.T) {
-	r := testMux(t)
-	code, _ := do(t, r, "GET", "/zqrandom-185-segment", "Bearer "+routesTok)
-	require.Equal(t, http.StatusNotFound, code)
-	_, body := do(t, r, "GET", "/metrics", "")
-	assert.NotContains(t, body, "zqrandom-185-segment", "the raw path became a metrics label")
-	assert.Contains(t, body, `path="unmatched"`)
-}

ingestion/cmd/server/symlink_check_test.go

@@ -1,9 +1,6 @@
 package main
 
 import (
-	"context"
-	"net/http"
-	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"strings"
@@ -77,16 +74,3 @@ func TestStartupSymlinkCheckRefusesABrainWithAFIFO(t *testing.T) {
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "classification.yaml")
 }
-
-// hyperguild#163: each alert source gets its own ntfy title.
-func TestBuildNotifierUsesTheGivenTitle(t *testing.T) {
-	var got string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { got = r.Header.Get("Title") }))
-	defer srv.Close()
-	env := map[string]string{"BRAIN_NTFY_URL": srv.URL}
-	n := buildNotifier(func(k string) string { return env[k] }, "brain symlink tripwire")
-	require.NotNil(t, n)
-	require.NoError(t, n.Notify(context.Background(), "m"))
-	assert.Equal(t, "brain symlink tripwire", got)
-	assert.Nil(t, buildNotifier(func(string) string { return "" }, "x"), "no ntfy URL, no notifier")
-}

ingestion/internal/audit/ntfy.go

@@ -13,14 +13,9 @@ import (
 type NtfyNotifier struct {
 	topicURL string
 	token    string
-	title    string
 	http     *http.Client
 }
 
-// defaultNtfyTitle is the title of a notifier built without WithTitle: the
-// capture audit's degraded-state alert, its first user.
-const defaultNtfyTitle = "brain-capture audit degraded"
-
 // NewNtfyNotifier constructs a notifier for the given ntfy topic URL
 // (e.g. https://ntfy.sh/my-topic). token is an optional bearer for
 // protected ntfy instances; it is held here and only sent in the
@@ -32,31 +27,17 @@ func NewNtfyNotifier(topicURL, token string) *NtfyNotifier {
 	return &NtfyNotifier{
 		topicURL: strings.TrimRight(topicURL, "/"),
 		token:    token,
-		title:    defaultNtfyTitle,
 		http:     &http.Client{Timeout: 10 * time.Second},
 	}
 }
 
-// WithTitle returns a copy that sends title as the ntfy Title header, so each
-// alert source (the capture audit, the symlink tripwire, governance edits)
-// is recognisable on the phone (hyperguild#163). A nil notifier (ntfy not
-// configured) stays nil.
-func (n *NtfyNotifier) WithTitle(title string) *NtfyNotifier {
-	if n == nil {
-		return nil
-	}
-	c := *n
-	c.title = title
-	return &c
-}
-
 // Notify posts a message to the ntfy topic.
 func (n *NtfyNotifier) Notify(ctx context.Context, msg string) error {
 	req, err := http.NewRequestWithContext(ctx, http.MethodPost, n.topicURL, strings.NewReader(msg))
 	if err != nil {
 		return err
 	}
-	req.Header.Set("Title", n.title)
+	req.Header.Set("Title", "brain-capture audit degraded")
 	req.Header.Set("Priority", "high")
 	req.Header.Set("Tags", "warning,brain")
 	if n.token != "" {

ingestion/internal/audit/ntfy_title_test.go

@@ -1,29 +0,0 @@
-package audit
-
-import (
-	"context"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// hyperguild#163: every alert went out titled "brain-capture audit
-// degraded", including the symlink tripwire's and governance alerts.
-func TestNtfyNotifierSendsItsOwnTitle(t *testing.T) {
-	var got []string
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		got = append(got, r.Header.Get("Title"))
-	}))
-	defer srv.Close()
-	base := NewNtfyNotifier(srv.URL, "")
-	require.NoError(t, base.Notify(context.Background(), "m"))
-	require.NoError(t, base.WithTitle("brain symlink tripwire").Notify(context.Background(), "m"))
-	require.NoError(t, base.Notify(context.Background(), "m"))
-	assert.Equal(t, []string{"brain-capture audit degraded", "brain symlink tripwire", "brain-capture audit degraded"}, got,
-		"WithTitle returns a copy; the base keeps its default title")
-	var nilN *NtfyNotifier
-	assert.Nil(t, nilN.WithTitle("x"), "nil (ntfy not configured) stays nil")
-}

ingestion/internal/brainfs/brainfs.go

@@ -109,7 +109,7 @@ func (b *Brain) ReadDirRegular(relDir string) ([]string, error) {
 // after following a symlink, and a ".." after a symlinked directory would
 // otherwise pass the check and redirect the read or write.
 func cleanRel(rel string) error {
-	if rel == "" || path.Clean(rel) != rel || !filepath.IsLocal(rel) || strings.Contains(rel, "\\") {
+	if rel == "" || path.Clean(rel) != rel || !filepath.IsLocal(rel) {
 		return fmt.Errorf("%q: not a clean brain-relative path: %w", rel, ErrNotRegular)
 	}
 	return nil
@@ -243,6 +243,27 @@ func (b *Brain) RealParent(rel string) error {
 	return b.realDir(path.Dir(rel))
 }
 
+// PutFile opens the brain dir as a root and calls PutRegular, for one-off
+// writers that hold no Brain.
+func PutFile(brainDir, rel string, data []byte) error {
+	b, err := Open(brainDir)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = b.Close() }()
+	return b.PutRegular(rel, data)
+}
+
+// AppendFile opens the brain dir as a root and calls AppendRegular.
+func AppendFile(brainDir, rel string, data []byte) error {
+	b, err := Open(brainDir)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = b.Close() }()
+	return b.AppendRegular(rel, data)
+}
+
 // mkdirReal makes sure every component of rel exists as a real directory,
 // creating missing ones through the root; an existing component that is
 // not a real directory is ErrNotRegular.

ingestion/internal/brainfs/brainfs_test.go

@@ -529,3 +529,20 @@ func TestCreateRegularCreatesOnlyNewFilesThroughRealDirectories(t *testing.T) {
 	got, _ = os.ReadFile(filepath.Join(dir, "wiki", "new", "facts", "n.md"))
 	assert.Equal(t, "one", string(got))
 }
+
+// On Linux a backslash is an ordinary filename byte, not a separator, so a
+// name containing one stays a single in-root component (hyperguild#158: the
+// watcher retried such a note forever while cleanRel refused it).
+func TestReadAndPutRegularTreatABackslashAsAFilenameByte(t *testing.T) {
+	dir := t.TempDir()
+	b, err := Open(dir)
+	require.NoError(t, err)
+	defer func() { _ = b.Close() }()
+	require.NoError(t, b.PutRegular(`a\..\b.md`, []byte("x")))
+	got, err := os.ReadFile(filepath.Join(dir, `a\..\b.md`))
+	require.NoError(t, err, "the name was not kept as one component")
+	assert.Equal(t, "x", string(got))
+	got, err = b.ReadRegular(`a\..\b.md`)
+	require.NoError(t, err)
+	assert.Equal(t, "x", string(got))
+}

ingestion/internal/extract/callsites_test.go

@@ -88,7 +88,6 @@ func TestNoPackageReferencesExtractTextOutsideExtract(t *testing.T) {
 // osOpenAllowed names the functions in guarded files that may call os.Open*
 // on a path that is not a raw/ read.
 var osOpenAllowed = map[string]bool{
-	"internal/watcher/watcher.go:appendWatcherLog": true, // ingest log append, not a raw/ read
 	// Text reads by path; outside this package only TextIn's temp copy reaches
 	// it (TestNoPackageReferencesExtractTextOutsideExtract enforces that).
 	"internal/extract/extract.go:Text": true,

ingestion/internal/metrics/metrics.go

@@ -83,9 +83,8 @@ func (r *Registry) Observe(path, status string, d time.Duration) {
 
 // Middleware wraps next, observing every request's duration + status.
 // The metric label `path` uses the request's Pattern (Go 1.22+ ServeMux),
-// or the fixed label "unmatched" if no Pattern is set: falling back to the
+// falling back to the URL path if no Pattern is set. Pattern keeps
-// raw URL path gave any caller one series per unique path (hyperguild#185).
+// cardinality bounded (one series per route, not one per unique URL).
-// Pattern keeps cardinality bounded (one series per route).
 func (r *Registry) Middleware(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
 		rec := &statusRecorder{ResponseWriter: w, code: http.StatusOK}
@@ -93,7 +92,7 @@ func (r *Registry) Middleware(next http.Handler) http.Handler {
 		next.ServeHTTP(rec, req)
 		path := req.Pattern
 		if path == "" {
-			path = "unmatched"
+			path = req.URL.Path
 		}
 		r.Observe(path, statusClass(rec.code), time.Since(start))
 	})

ingestion/internal/metrics/metrics_test.go

@@ -71,16 +71,11 @@ func TestMiddleware_RecordsTiming(t *testing.T) {
 	t.Parallel()
 
 	r := New()
-	// Routed through a ServeMux, as in production: the mux sets the
+	handler := r.Middleware(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-	// request's Pattern, which is the label (an unrouted request is
-	// "unmatched", hyperguild#185).
-	mux := http.NewServeMux()
-	mux.HandleFunc("/query", func(w http.ResponseWriter, _ *http.Request) {
 		time.Sleep(2 * time.Millisecond)
 		w.WriteHeader(http.StatusOK)
 		_, _ = io.WriteString(w, "ok")
-	})
+	}))
-	handler := r.Middleware(mux)
 
 	srv := httptest.NewServer(handler)
 	defer srv.Close()
@@ -122,19 +117,3 @@ func TestStatusRecorder_DefaultsTo200(t *testing.T) {
 		t.Errorf("code %d, want 200", rec.Code)
 	}
 }
-
-// A request with no matched Pattern is labelled "unmatched", never with its
-// raw URL path (unbounded cardinality, hyperguild#185).
-func TestMiddleware_LabelsAnUnmatchedRequestWithAFixedLabel(t *testing.T) {
-	r := New()
-	h := r.Middleware(http.NotFoundHandler())
-	h.ServeHTTP(httptest.NewRecorder(), httptest.NewRequest("GET", "/zqrandom-185-unit", nil))
-	rec := httptest.NewRecorder()
-	r.Handler().ServeHTTP(rec, httptest.NewRequest("GET", "/metrics", nil))
-	if strings.Contains(rec.Body.String(), "zqrandom-185-unit") {
-		t.Errorf("the raw path became a metrics label:\n%s", rec.Body.String())
-	}
-	if !strings.Contains(rec.Body.String(), `path="unmatched"`) {
-		t.Errorf("no unmatched label:\n%s", rec.Body.String())
-	}
-}

ingestion/internal/pipeline/backfill.go

@@ -7,8 +7,6 @@ import (
 	"fmt"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
 	"io/fs"
-	"os"
-	"path/filepath"
 	"strings"
 
 	"github.com/mathiasbq/hyperguild/ingestion/internal/wiki"
@@ -90,8 +88,7 @@ func BackfillRefs(ctx context.Context, brainDir string) (int, error) {
 	}
 
 	for relPath, page := range pending {
-		dest := filepath.Join(brainDir, filepath.FromSlash(relPath))
+		if err := bfs.PutRegular(relPath, []byte(page.Content)); err != nil {
-		if err := os.WriteFile(dest, []byte(page.Content), 0o644); err != nil {
 			return 0, fmt.Errorf("write %s: %w", relPath, err)
 		}
 	}

ingestion/internal/pipeline/pipeline.go

@@ -9,8 +9,6 @@ import (
 	"fmt"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
 	"io/fs"
-	"os"
-	"path/filepath"
 	"strings"
 	"time"
 
@@ -128,10 +126,6 @@ func buildAndWrite(ctx context.Context, rawPages []RawPage, sourceSlug, date, br
 	var written []string
 	for _, page := range merged {
 		if !dryRun {
-			dest := filepath.Join(brainDir, filepath.FromSlash(page.Path))
-			if err := os.MkdirAll(filepath.Dir(dest), 0o755); err != nil {
-				return Result{}, fmt.Errorf("mkdir for %s: %w", page.Path, err)
-			}
 			content, conflicts, err := reviseOrCreate(brainDir, page)
 			if err != nil {
 				return Result{}, err
@@ -150,7 +144,9 @@ func buildAndWrite(ctx context.Context, rawPages []RawPage, sourceSlug, date, br
 			if err != nil {
 				return Result{}, fmt.Errorf("stamp %s: %w", page.Path, err)
 			}
-			if err := os.WriteFile(dest, []byte(stamped), 0o644); err != nil {
+			// Written through the brain root, never through a symlinked
+			// directory or page (hyperguild#158).
+			if err := writeBrainFile(brainDir, page.Path, []byte(stamped)); err != nil {
 				return Result{}, fmt.Errorf("write %s: %w", page.Path, err)
 			}
 		}
@@ -201,6 +197,17 @@ func readSourcePage(brainDir, sourceSlug string) string {
 	return string(raw)
 }
 
+// writeBrainFile creates or replaces one brain-relative file through the
+// brain root (hyperguild#158).
+func writeBrainFile(brainDir, rel string, data []byte) error {
+	bfs, err := brainfs.Open(brainDir)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = bfs.Close() }()
+	return bfs.PutRegular(rel, data)
+}
+
 // readBrainFile reads one brain-relative file through the brain root,
 // regular files only (hyperguild#157).
 func readBrainFile(brainDir, rel string) ([]byte, error) {

ingestion/internal/pipeline/root_test.go

@@ -165,3 +165,53 @@ func TestBackfillRefsDoesNotCopyAPageSwappedInBehindASymlink(t *testing.T) {
 	require.Contains(t, read(), "[[s|S]]", "positive control: the regular page gets the source ref")
 	brainfstest.AssertNoLeakFrom(t, page, inside, target, 3*time.Second, read)
 }
+
+// hyperguild#158: BackfillRefs read a regular concept page, a symlink could
+// be swapped in, and os.WriteFile then followed it and overwrote the link's
+// target. The target is not restored between rounds here, so any
+// write-through shows.
+func TestBackfillRefsNeverWritesThroughAPageSwappedForASymlink(t *testing.T) {
+	brain := t.TempDir()
+	mkdirs(t, brain, "wiki/sources", "wiki/concepts", "raw")
+	require.NoError(t, os.WriteFile(filepath.Join(brain, "wiki", "sources", "s.md"), []byte("---\ntitle: S\n---\n[[c|C]]\n"), 0o644))
+	page := filepath.Join(brain, "wiki", "concepts", "c.md")
+	target := filepath.Join(brain, "raw", "secret.md")
+	require.NoError(t, os.WriteFile(target, []byte("untouched"), 0o644))
+	inside := "---\ntitle: C\n---\nbody\n"
+	require.NoError(t, os.WriteFile(page, []byte(inside), 0o644))
+	brainfstest.StartSwap(t, page, inside, target, false)
+	ok := 0
+	for deadline := time.Now().Add(2 * time.Second); time.Now().Before(deadline); {
+		if _, err := BackfillRefs(context.Background(), brain); err == nil {
+			ok++
+		}
+	}
+	got, _ := os.ReadFile(target)
+	assert.Equal(t, "untouched", string(got), "BackfillRefs wrote through a swapped-in symlink")
+	assert.Positive(t, ok, "positive control: some backfills ran")
+}
+
+// hyperguild#158: buildAndWrite wrote each page with os.WriteFile by path, so
+// a page read as regular and swapped for a symlink before the write was
+// written through. The target is not restored between rounds, so any
+// write-through shows.
+func TestBuildAndWriteNeverWritesThroughAPageSwappedForASymlink(t *testing.T) {
+	brain := t.TempDir()
+	mkdirs(t, brain, "wiki/sources", "wiki/concepts", "wiki/entities", "raw")
+	page := filepath.Join(brain, "wiki", "concepts", "zq-concept.md")
+	target := filepath.Join(brain, "raw", "secret.md")
+	require.NoError(t, os.WriteFile(target, []byte("untouched"), 0o644))
+	inside := "---\ntitle: Zq Concept\n---\nbody\n"
+	require.NoError(t, os.WriteFile(page, []byte(inside), 0o644))
+	pages := []RawPage{{Title: "Zq Concept", Type: "concept", Content: "## About\n\nmore\n"}}
+	brainfstest.StartSwap(t, page, inside, target, false)
+	ok := 0
+	for deadline := time.Now().Add(2 * time.Second); time.Now().Before(deadline); {
+		if _, err := RunRaw(context.Background(), brain, "zq source", pages, false); err == nil {
+			ok++
+		}
+	}
+	got, _ := os.ReadFile(target)
+	assert.Equal(t, "untouched", string(got), "buildAndWrite wrote through a swapped-in symlink")
+	assert.Positive(t, ok, "positive control: some runs returned without error")
+}

ingestion/internal/symlinkguard/symlinkguard_test.go

@@ -381,19 +381,18 @@ func TestWatchQueueIsBoundedDuringAnOutage(t *testing.T) {
 		require.Eventually(t, func() bool { _, err := os.Lstat(link); return os.IsNotExist(err) }, 2*time.Second, 2*time.Millisecond)
 	}
 	n.down.Store(false)
-	// Synchronise on the summary being delivered (hyperguild#193: a fixed
+	require.Eventually(t, func() bool { return n.count() >= 1 }, 2*time.Second, 5*time.Millisecond)
-	// sleep flaked under load); once it is, the queue has been flushed.
+	time.Sleep(100 * time.Millisecond)
-	require.Eventually(t, func() bool {
+	assert.LessOrEqual(t, n.count(), maxPending+1, "queued alerts plus at most one suppression summary")
 	n.mu.Lock()
 	defer n.mu.Unlock()
+	found := false
 	for _, m := range n.msgs {
 		if strings.Contains(m, "suppressed") {
-				return true
+			found = true
 		}
 	}
-		return false
+	assert.True(t, found, "suppressed alerts are counted in a summary")
-	}, 10*time.Second, 5*time.Millisecond, "suppressed alerts are counted in a summary")
-	assert.LessOrEqual(t, n.count(), maxPending+1, "queued alerts plus at most one suppression summary")
 }
 
 // Within the bound, every alert queued during an outage is delivered after
@@ -412,21 +411,11 @@ func TestWatchDeliversEveryQueuedAlertAfterAShortOutage(t *testing.T) {
 		require.Eventually(t, func() bool { _, err := os.Lstat(link); return os.IsNotExist(err) }, 2*time.Second, 2*time.Millisecond)
 	}
 	n.down.Store(false)
-	require.Eventually(t, func() bool { return n.count() >= 3 }, 10*time.Second, 5*time.Millisecond)
+	require.Eventually(t, func() bool { return n.count() == 3 }, 2*time.Second, 5*time.Millisecond)
 	n.mu.Lock()
 	defer n.mu.Unlock()
-	// Each removal delivered exactly once, in any order: the outage ends
+	for i, name := range []string{"qa", "qb", "qc"} {
-	// asynchronously, possibly mid-flush, so a later item can send before an
+		assert.Contains(t, n.msgs[i], strconv.Quote(name))
-	// earlier one (hyperguild#193). Order is not what this test is about.
-	assert.Len(t, n.msgs, 3)
-	for _, name := range []string{"qa", "qb", "qc"} {
-		hits := 0
-		for _, m := range n.msgs {
-			if strings.Contains(m, strconv.Quote(name)) {
-				hits++
-			}
-		}
-		assert.Equal(t, 1, hits, "%s delivered exactly once", name)
 	}
 }
 
@@ -468,30 +457,29 @@ func TestWatchAccountsForEveryRemovalDuringAnOutage(t *testing.T) {
 		require.Eventually(t, func() bool { _, err := os.Lstat(link); return os.IsNotExist(err) }, 2*time.Second, 1*time.Millisecond)
 	}
 	n.down.Store(false)
-	// Synchronise on the record being complete, not on a fixed sleep after
+	require.Eventually(t, func() bool {
-	// the first summary (hyperguild#193): sum every "removed N" alert and
-	// every suppression count until they account for all plants.
-	account := func() (delivered, counted int) {
 		n.mu.Lock()
 		defer n.mu.Unlock()
 		for _, m := range n.msgs {
-			var k int
+			if strings.Contains(m, "suppressed") {
-			if i := strings.Index(m, "removed "); i >= 0 && strings.Contains(m, "symlink(s)") {
+				return true
-				if _, err := fmt.Sscanf(m[i+len("removed "):], "%d", &k); err == nil {
-					delivered += k
 			}
 		}
+		return false
+	}, 2*time.Second, 5*time.Millisecond)
+	time.Sleep(50 * time.Millisecond)
+	n.mu.Lock()
+	defer n.mu.Unlock()
+	delivered, counted := 0, 0
+	for _, m := range n.msgs {
+		if strings.Contains(m, "removed 1 symlink(s)") {
+			delivered++
+		}
 		if i := strings.Index(m, "): "); i >= 0 && strings.Contains(m, "suppressed") {
-				if _, err := fmt.Sscanf(m[i+3:], "%d", &k); err == nil {
+			_, _ = fmt.Sscanf(m[i+3:], "%d", &counted)
-					counted += k
 		}
 	}
-		}
+	assert.Equal(t, plants, delivered+counted, "delivered %d + counted %d must equal %d removals", delivered, counted, plants)
-		return delivered, counted
-	}
-	require.Eventually(t, func() bool { d, c := account(); return d+c >= plants }, 10*time.Second, 5*time.Millisecond)
-	d, c := account()
-	assert.Equal(t, plants, d+c, "delivered %d + counted %d must equal %d removals", d, c, plants)
 }
 
 // A poison message is still dropped (others send while it fails), and the

ingestion/internal/watcher/watcher.go

@@ -3,6 +3,7 @@ package watcher
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"log/slog"
@@ -13,6 +14,7 @@ import (
 	"time"
 	"unicode"
 
+	"github.com/mathiasbq/hyperguild/ingestion/internal/brainfs"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/extract"
 	"github.com/mathiasbq/hyperguild/ingestion/internal/pipeline"
 )
@@ -22,19 +24,11 @@ type Config struct {
 	BrainDir string
 	Interval time.Duration
 	Pipeline pipeline.Config
-
-	// stuck remembers notes that were ingested but could neither be removed
-	// from raw/ nor marked (e.g. a read-only raw/), so later polls skip them
-	// instead of ingesting them again. In memory only: a restart retries once.
-	stuck *sync.Map
 }
 
 // Start launches the watcher in a background goroutine.
 // It returns immediately. The watcher stops when ctx is cancelled.
 func Start(ctx context.Context, cfg Config) {
-	if cfg.stuck == nil {
-		cfg.stuck = &sync.Map{}
-	}
 	go func() {
 		ticker := time.NewTicker(cfg.Interval)
 		defer ticker.Stop()
@@ -117,21 +111,29 @@ func processDir(ctx context.Context, cfg Config, date string) []error {
 			return nil
 		}
 
-		if cfg.stuck != nil {
-			if _, skip := cfg.stuck.Load(path); skip {
-				return nil
-			}
-		}
-
 		// Skip files that have already been processed or permanently failed.
-		if _, err := os.Stat(path + ".processed"); err == nil {
+		// Any entry at the marker path counts (Lstat, not Stat): a dangling
+		// marker symlink made os.Stat report nothing and the note was
+		// reprocessed every interval (hyperguild#158).
+		if _, err := os.Lstat(path + ".processed"); err == nil {
 			return nil
 		}
-		if _, err := os.Stat(path + ".failed"); err == nil {
+		if _, err := os.Lstat(path + ".failed"); err == nil {
+			return nil
+		}
+		// A note whose archive copy or marker was refused is not retried
+		// until it changes: a refusal has no marker to stop the next round,
+		// and each round can cost an LLM call (hyperguild#158).
+		info, ierr := d.Info()
+		if ierr == nil && refusedUnchanged(path, info) {
 			return nil
 		}
 
 		if err := processFile(ctx, cfg, root, rawDir, path, date); err != nil {
+			if ierr == nil && errors.Is(err, brainfs.ErrNotRegular) {
+				rememberRefused(path, info)
+				slog.Error("watcher: note refused; not retried until it changes", "file", filepath.Base(path), "error", err)
+			}
 			errs = append(errs, fmt.Errorf("process %s: %w", filepath.Base(path), err))
 		}
 		return nil
@@ -142,12 +144,9 @@ func processDir(ctx context.Context, cfg Config, date string) []error {
 	return errs
 }
 
-// processFile reads a file, calls pipeline.Run, and archives it into processed/
+// processFile reads a file, calls pipeline.Run, copies it to processed/ or failed/,
-// or failed/. The original is then removed from raw/ so that raw/ only ever
+// and writes a marker file next to the original so the watcher skips it next poll.
-// holds unprocessed input (inbox zero). The removal syncs to Syncthing peers;
+// The original file is never deleted, keeping Syncthing-connected vaults (e.g. Obsidian) intact.
-// the archive copy under raw/processed/ or raw/failed/ is what they keep. A
-// marker is written next to the original only if the removal fails, so a
-// stuck file is not re-ingested every poll.
 func processFile(ctx context.Context, cfg Config, root *os.Root, rawDir, path, date string) error {
 	filename := filepath.Base(path)
 	source := deriveSource(filename)
@@ -156,10 +155,6 @@ func processFile(ctx context.Context, cfg Config, root *os.Root, rawDir, path, d
 		return fmt.Errorf("relative path: %w", err)
 	}
 
-	before, err := root.Lstat(rel)
-	if err != nil {
-		return fmt.Errorf("stat before ingest: %w", err)
-	}
 	content, err := extract.TextIn(root, rel)
 	if err != nil {
 		return fmt.Errorf("extract text: %w", err)
@@ -167,20 +162,17 @@ func processFile(ctx context.Context, cfg Config, root *os.Root, rawDir, path, d
 
 	_, runErr := pipeline.Run(ctx, cfg.Pipeline, cfg.BrainDir, content, source, false)
 	if runErr != nil {
-		// Copy to failed/ and leave a .failed marker so we don't retry.
+		// Copy to failed/ and leave a .failed marker so we don't retry. Both
-		failedDir := filepath.Join(cfg.BrainDir, "raw", "failed")
+		// written through the brain root (hyperguild#158).
-		if mkErr := os.MkdirAll(failedDir, 0o755); mkErr != nil {
+		if cpErr := copyFromRoot(root, rel, cfg.BrainDir, "raw/failed/"+filename); cpErr != nil {
-			return fmt.Errorf("mkdir failed dir: %w", mkErr)
-		}
-		dest := filepath.Join(failedDir, filename)
-		if cpErr := copyFromRoot(root, rel, dest); cpErr != nil {
 			return fmt.Errorf("copy to failed: %w", cpErr)
 		}
-		if changedSince(root, rel, before) {
+		if mkErr := putBrainFile(cfg.BrainDir, "raw/"+filepath.ToSlash(rel)+".failed", []byte(runErr.Error())); mkErr != nil {
-			slog.Warn("watcher: note changed during ingest; leaving it in raw/ for the next poll", "file", filename)
+			if errors.Is(mkErr, brainfs.ErrNotRegular) {
-			return nil
+				return fmt.Errorf("write .failed marker: %w", mkErr)
+			}
+			slog.Error("watcher: failed to write .failed marker", "error", mkErr)
 		}
-		retire(cfg, root, rel, path, ".failed", runErr.Error())
 
 		slog.Warn("watcher: file failed", "file", filename, "error", runErr)
 
@@ -192,57 +184,52 @@ func processFile(ctx context.Context, cfg Config, root *os.Root, rawDir, path, d
 	}
 
 	// Copy to processed/YYYY-MM-DD/ and leave a .processed marker so we don't re-ingest.
-	processedDir := filepath.Join(cfg.BrainDir, "raw", "processed", date)
+	// Written through the brain root (hyperguild#158).
-	if err := os.MkdirAll(processedDir, 0o755); err != nil {
+	dest := "raw/processed/" + date + "/" + filename
-		return fmt.Errorf("mkdir processed dir: %w", err)
+	if _, err := os.Lstat(filepath.Join(cfg.BrainDir, filepath.FromSlash(dest))); err == nil {
-	}
-	dest := filepath.Join(processedDir, filename)
-	if _, err := os.Stat(dest); err == nil {
 		// Archive copy already exists; append timestamp to avoid overwriting.
 		ext := filepath.Ext(filename)
 		base := strings.TrimSuffix(filename, ext)
-		dest = filepath.Join(processedDir, base+"-"+time.Now().UTC().Format("150405")+ext)
+		dest = "raw/processed/" + date + "/" + base + "-" + time.Now().UTC().Format("150405") + ext
 	}
-	if err := copyFromRoot(root, rel, dest); err != nil {
+	if err := copyFromRoot(root, rel, cfg.BrainDir, dest); err != nil {
 		return fmt.Errorf("copy to processed: %w", err)
 	}
-	if changedSince(root, rel, before) {
+	if err := putBrainFile(cfg.BrainDir, "raw/"+filepath.ToSlash(rel)+".processed", []byte(date)); err != nil {
-		slog.Warn("watcher: note changed during ingest; leaving it in raw/ for the next poll", "file", filename)
+		if errors.Is(err, brainfs.ErrNotRegular) {
-		return nil
+			return fmt.Errorf("write .processed marker: %w", err)
+		}
+		slog.Error("watcher: failed to write .processed marker", "error", err)
 	}
-	retire(cfg, root, rel, path, ".processed", date)
 
 	slog.Info("watcher: file processed", "file", filename, "source", source)
 	return nil
 }
 
-// changedSince reports whether the note at rel differs (size or mtime) from
+// refused remembers notes whose archive copy or marker write was refused,
-// before. A note replaced mid-ingest (Syncthing) was extracted from older
+// by path, with the size and mtime they had, for the life of the process.
-// content than it now holds, so it must not be removed. Limits: a same-size
+var refused sync.Map
-// rewrite with a restored mtime is not detected (the new bytes then survive
+
-// only in the archive copy), nor a change between this check and Remove.
+type refusedStamp struct {
-func changedSince(root *os.Root, rel string, before os.FileInfo) bool {
+	size  int64
-	now, err := root.Lstat(rel)
+	mtime time.Time
-	if err != nil {
-		return true
-	}
-	return now.Size() != before.Size() || !now.ModTime().Equal(before.ModTime())
 }
 
-// retire removes an archived original from raw/ (inbox zero). If the removal
+func rememberRefused(path string, info os.FileInfo) {
-// fails it falls back to a marker file so the watcher still skips the file.
+	refused.Store(path, refusedStamp{size: info.Size(), mtime: info.ModTime()})
-func retire(cfg Config, root *os.Root, rel, path, markerSuffix, markerBody string) {
-	rmErr := root.Remove(rel)
-	if rmErr == nil {
-		return
 }
-	slog.Error("watcher: failed to remove archived original; writing marker", "file", rel, "error", rmErr)
+
-	if err := os.WriteFile(path+markerSuffix, []byte(markerBody), 0o644); err != nil {
+func refusedUnchanged(path string, info os.FileInfo) bool {
-		slog.Error("watcher: failed to write marker; skipping this note until restart", "file", rel, "error", err)
+	v, ok := refused.Load(path)
-		if cfg.stuck != nil {
+	if !ok {
-			cfg.stuck.Store(path, struct{}{})
+		return false
 	}
+	st := v.(refusedStamp)
+	if st.size == info.Size() && st.mtime.Equal(info.ModTime()) {
+		return true
 	}
+	refused.Delete(path)
+	return false
 }
 
 // deriveSource turns a filename into a human-readable source name.
@@ -269,23 +256,22 @@ func appendWatcherLog(brainDir, filename string, runErr error, date string) erro
 	entry := fmt.Sprintf("## %s — watcher error\n\n- **File:** %s\n- **Error:** %s\n\n",
 		date, filename, runErr.Error())
 
-	logPath := filepath.Join(brainDir, "log.md")
+	if err := brainfs.AppendFile(brainDir, "log.md", []byte(entry)); err != nil {
-	f, err := os.OpenFile(logPath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o644)
-	if err != nil {
-		return fmt.Errorf("open log: %w", err)
-	}
-
-	if _, err = f.WriteString(entry); err != nil {
-		f.Close() //nolint:errcheck
 		return fmt.Errorf("write log: %w", err)
 	}
-	return f.Close()
+	return nil
+}
+
+// putBrainFile creates or replaces a brain-relative file through the brain
+// root, never through a symlinked directory or file (hyperguild#158).
+func putBrainFile(brainDir, rel string, data []byte) error {
+	return brainfs.PutFile(brainDir, rel, data)
 }
 
 // copyFromRoot archives a raw/ file read through the root, refusing anything
 // that is not a regular file, so a swapped-in symlink cannot copy an outside
 // file into raw/processed/ or raw/failed/ (hyperguild#153).
-func copyFromRoot(root *os.Root, rel, dst string) error {
+func copyFromRoot(root *os.Root, rel, brainDir, dstRel string) error {
 	fi, err := root.Lstat(rel)
 	if err != nil {
 		return err
@@ -298,13 +284,9 @@ func copyFromRoot(root *os.Root, rel, dst string) error {
 		return err
 	}
 	defer func() { _ = in.Close() }()
-	out, err := os.Create(dst)
+	data, err := io.ReadAll(in)
 	if err != nil {
 		return err
 	}
-	if _, err := io.Copy(out, in); err != nil {
+	return putBrainFile(brainDir, dstRel, data)
-		_ = out.Close()
-		return err
-	}
-	return out.Close()
 }

ingestion/internal/watcher/watcher_test.go

@@ -89,12 +89,13 @@ func TestStart_ProcessesFile(t *testing.T) {
 	}
 	require.True(t, found, "file should be copied to processed/")
 
-	// Inbox zero: once archived, the original leaves raw/ and no marker is
+	// Original file should still exist (copy, not move — keeps Obsidian vault intact).
-	// left behind, so what remains in raw/ is exactly the unprocessed set.
 	_, err := os.Stat(rawFile)
-	assert.ErrorIs(t, err, os.ErrNotExist, "original should be removed from raw/ once archived")
+	assert.NoError(t, err, "original file should remain in raw/")
+
+	// A .processed marker should exist next to the original.
 	_, err = os.Stat(rawFile + ".processed")
-	assert.ErrorIs(t, err, os.ErrNotExist, "no .processed marker: the archive copy is the record")
+	assert.NoError(t, err, ".processed marker should be written")
 
 	// Wiki page should exist.
 	wikiPath := filepath.Join(brainDir, "wiki", "sources", "shape-up-book.md")
@@ -141,11 +142,13 @@ func TestStart_MovesToFailedOnError(t *testing.T) {
 	}
 	require.True(t, found, "file should be copied to failed/")
 
-	// Inbox zero: a quarantined original leaves raw/ too, no marker beside it.
+	// Original file should still exist (copy, not move — keeps Obsidian vault intact).
 	_, err := os.Stat(rawFile)
-	assert.ErrorIs(t, err, os.ErrNotExist, "original should be removed from raw/ once quarantined")
+	assert.NoError(t, err, "original file should remain in raw/")
+
+	// A .failed marker should exist next to the original.
 	_, err = os.Stat(rawFile + ".failed")
-	assert.ErrorIs(t, err, os.ErrNotExist, "no .failed marker: failed/ is the record")
+	assert.NoError(t, err, ".failed marker should be written")
 
 	// log.md should contain a watcher error entry.
 	logContent, err := os.ReadFile(filepath.Join(brainDir, "log.md"))
@@ -387,86 +390,3 @@ func TestProcessDir_DoesNotHangUnderAFIFOSwapRace(t *testing.T) {
 		t.Fatalf("the watcher hung on a swapped-in FIFO after %d iterations", iters.Load())
 	}
 }
-
-// A note whose removal AND marker write both fail (read-only raw/) must not be
-// re-ingested on every poll: each pass would write another archive copy.
-func TestProcessDir_DoesNotReingestANoteItCannotRetire(t *testing.T) {
-	brainDir := setupBrainDir(t)
-	rawDir := filepath.Join(brainDir, "raw")
-	require.NoError(t, os.WriteFile(filepath.Join(rawDir, "stuck.md"), []byte("Content."), 0o644))
-	// processed/ must exist and stay writable; only raw/ itself is locked.
-	require.NoError(t, os.MkdirAll(filepath.Join(rawDir, "processed"), 0o755))
-	require.NoError(t, os.Chmod(rawDir, 0o555))
-	t.Cleanup(func() { _ = os.Chmod(rawDir, 0o755) })
-
-	var calls atomic.Int32
-	cfg := Config{
-		BrainDir: brainDir,
-		Pipeline: pipeline.Config{
-			Complete: func(ctx context.Context, s, u string) (string, error) {
-				calls.Add(1)
-				return successComplete(pipeline.RawPage{Title: "Stuck", Type: "source", Subtype: "article", Content: "x\n"})(ctx, s, u)
-			},
-			Schema: "# Schema",
-		},
-		stuck: &sync.Map{},
-	}
-	for i := 0; i < 3; i++ {
-		processDir(context.Background(), cfg, "2026-10-19")
-	}
-	assert.Equal(t, int32(1), calls.Load(), "a note that cannot be retired is ingested once, not once per poll")
-}
-
-// If the archive copy cannot be written, the original is the only copy left:
-// it must stay in raw/.
-func TestProcessDir_KeepsTheOriginalWhenTheArchiveCopyFails(t *testing.T) {
-	brainDir := setupBrainDir(t)
-	rawDir := filepath.Join(brainDir, "raw")
-	note := filepath.Join(rawDir, "keep-me.md")
-	require.NoError(t, os.WriteFile(note, []byte("Content."), 0o644))
-	// The dated archive dir exists but is read-only: MkdirAll succeeds, the
-	// copy itself (os.Create) fails.
-	dated := filepath.Join(rawDir, "processed", "2026-10-19")
-	require.NoError(t, os.MkdirAll(dated, 0o755))
-	require.NoError(t, os.Chmod(dated, 0o555))
-	t.Cleanup(func() { _ = os.Chmod(dated, 0o755) })
-
-	cfg := Config{
-		BrainDir: brainDir,
-		Pipeline: pipeline.Config{
-			Complete: successComplete(pipeline.RawPage{Title: "Keep Me", Type: "source", Subtype: "article", Content: "x\n"}),
-			Schema:   "# Schema",
-		},
-	}
-	errs := processDir(context.Background(), cfg, "2026-10-19")
-
-	assert.NotEmpty(t, errs, "the failed archive is reported")
-	_, err := os.Stat(note)
-	assert.NoError(t, err, "original stays in raw/ when it could not be archived")
-}
-
-// If the note is replaced (e.g. by Syncthing) while it is being ingested, the
-// wiki page was extracted from the old content; removing the original would
-// leave the new content only in the archive and never re-ingest it. Observes
-// size/mtime change only: a same-size rewrite with a restored mtime is not caught.
-func TestProcessDir_KeepsANoteThatChangedWhileItWasBeingIngested(t *testing.T) {
-	brainDir := setupBrainDir(t)
-	note := filepath.Join(brainDir, "raw", "edited.md")
-	require.NoError(t, os.WriteFile(note, []byte("old"), 0o644))
-
-	cfg := Config{
-		BrainDir: brainDir,
-		Pipeline: pipeline.Config{
-			Complete: func(ctx context.Context, s, u string) (string, error) {
-				require.NoError(t, os.WriteFile(note, []byte("newer and longer content"), 0o644))
-				return successComplete(pipeline.RawPage{Title: "Edited", Type: "source", Subtype: "article", Content: "x\n"})(ctx, s, u)
-			},
-			Schema: "# Schema",
-		},
-	}
-	processDir(context.Background(), cfg, "2026-10-19")
-
-	got, err := os.ReadFile(note)
-	require.NoError(t, err, "a note that changed during ingest must stay in raw/")
-	assert.Equal(t, "newer and longer content", string(got))
-}

ingestion/internal/watcher/writes_redirect_test.go

@@ -0,0 +1,186 @@
+package watcher
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/mathiasbq/hyperguild/ingestion/internal/pipeline"
+)
+
+func okPipeline() pipeline.Config {
+	return pipeline.Config{Complete: func(context.Context, string, string) (string, error) {
+		b, _ := json.Marshal([]pipeline.RawPage{{Title: "X", Type: "source", Subtype: "article", Content: "## S\n\nx\n"}})
+		return string(b), nil
+	}, Schema: "# Schema"}
+}
+
+func failingPipeline() pipeline.Config {
+	return pipeline.Config{Complete: func(context.Context, string, string) (string, error) {
+		return "", errors.New("model down")
+	}, Schema: "# Schema"}
+}
+
+// hyperguild#158: the watcher wrote the archive copy under raw/processed or
+// raw/failed, and its log.md entry, by path, so a symlinked archive
+// directory or log redirected the write elsewhere in the brain or outside
+// it. (A pre-planted marker symlink makes the watcher skip the note, so the
+// marker write itself is reachable only by a race.)
+func TestProcessDirDoesNotWriteThroughASymlinkedArchiveDir(t *testing.T) {
+	for name, pcfg := range map[string]pipeline.Config{"processed": okPipeline(), "failed": failingPipeline()} {
+		t.Run(name, func(t *testing.T) {
+			brainDir := setupBrainDir(t)
+			outside := t.TempDir()
+			victim := filepath.Join(brainDir, "wiki", "concepts", "v.md")
+			require.NoError(t, os.WriteFile(victim, []byte("untouched"), 0o644))
+			require.NoError(t, os.WriteFile(filepath.Join(brainDir, "raw", "n.md"), []byte("note"), 0o644))
+			require.NoError(t, os.Symlink(outside, filepath.Join(brainDir, "raw", name)))
+			_ = processDir(context.Background(), Config{BrainDir: brainDir, Interval: time.Hour, Pipeline: pcfg}, "2026-10-05")
+			got, _ := os.ReadFile(victim)
+			assert.Equal(t, "untouched", string(got))
+			ents, _ := os.ReadDir(outside)
+			assert.Empty(t, ents, "the archive copy was written outside the brain")
+		})
+	}
+}
+
+func TestProcessDirWritesMarkersAndArchiveInRealDirectories(t *testing.T) {
+	brainDir := setupBrainDir(t)
+	require.NoError(t, os.WriteFile(filepath.Join(brainDir, "raw", "n.md"), []byte("note"), 0o644))
+	errs := processDir(context.Background(), Config{BrainDir: brainDir, Interval: time.Hour, Pipeline: okPipeline()}, "2026-10-05")
+	assert.Empty(t, errs)
+	_, err := os.Stat(filepath.Join(brainDir, "raw", "n.md.processed"))
+	assert.NoError(t, err, "positive control: marker written")
+	_, err = os.Stat(filepath.Join(brainDir, "raw", "processed", "2026-10-05", "n.md"))
+	assert.NoError(t, err, "positive control: archive copy written")
+}
+
+// The log.md entry for a failed note is appended through the brain root: with
+// a real raw/failed (so the archive copy succeeds and the log is reached), a
+// symlinked log.md is not written through.
+func TestProcessDirDoesNotAppendTheLogThroughASymlink(t *testing.T) {
+	brainDir := setupBrainDir(t)
+	victim := filepath.Join(brainDir, "wiki", "concepts", "v.md")
+	require.NoError(t, os.WriteFile(victim, []byte("untouched"), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(brainDir, "raw", "n.md"), []byte("note"), 0o644))
+	require.NoError(t, os.Symlink(filepath.Join("wiki", "concepts", "v.md"), filepath.Join(brainDir, "log.md")))
+	_ = processDir(context.Background(), Config{BrainDir: brainDir, Interval: time.Hour, Pipeline: failingPipeline()}, "2026-10-05")
+	_, err := os.Stat(filepath.Join(brainDir, "raw", "failed", "n.md"))
+	require.NoError(t, err, "positive control: the archive copy was written, so the log append was reached")
+	got, _ := os.ReadFile(victim)
+	assert.Equal(t, "untouched", string(got), "the log was appended through a symlink")
+}
+
+// A marker path holding anything (here a dangling symlink) counts as a
+// marker: the note is skipped and nothing is created at the link's target.
+// (os.Stat followed the link, saw nothing, and processed the note again.)
+func TestProcessDirTreatsAnyEntryAtTheMarkerPathAsAMarker(t *testing.T) {
+	for _, kind := range []string{"processed", "failed"} {
+		t.Run(kind, func(t *testing.T) {
+			brainDir := setupBrainDir(t)
+			outside := filepath.Join(t.TempDir(), "created")
+			require.NoError(t, os.WriteFile(filepath.Join(brainDir, "raw", "n.md"), []byte("note"), 0o644))
+			require.NoError(t, os.Symlink(outside, filepath.Join(brainDir, "raw", "n.md."+kind)))
+			calls := 0
+			cfg := Config{BrainDir: brainDir, Interval: time.Hour, Pipeline: pipeline.Config{
+				Complete: func(context.Context, string, string) (string, error) { calls++; return "[]", nil }, Schema: "# Schema"}}
+			_ = processDir(context.Background(), cfg, "2026-10-05")
+			assert.Zero(t, calls, "the note was processed despite an entry at its marker path")
+			_, err := os.Lstat(outside)
+			assert.True(t, os.IsNotExist(err), "a file was created at the marker link's target")
+		})
+	}
+}
+
+// The marker write itself is reachable while pipeline.Run is in flight
+// (in production, an LLM call): a link planted at the marker path then is
+// refused, and the note is remembered, so removing the link (as
+// symlinkguard does) does not make the watcher call the model again.
+func TestProcessDirRefusesAMarkerLinkPlantedDuringTheRunAndDoesNotRetry(t *testing.T) {
+	for _, kind := range []string{"processed", "failed"} {
+		for _, target := range []string{"outside", "in-brain"} {
+			t.Run(kind+"/"+target, func(t *testing.T) {
+				brainDir := setupBrainDir(t)
+				raw := filepath.Join(brainDir, "raw")
+				marker := filepath.Join(raw, "n.md."+kind)
+				require.NoError(t, os.WriteFile(filepath.Join(raw, "n.md"), []byte("note"), 0o644))
+				// The in-brain target is relative, so os.Root itself would
+				// follow it; only the regular-file check refuses it.
+				victim := filepath.Join(raw, "victim")
+				link := filepath.Join(t.TempDir(), "created")
+				if target == "in-brain" {
+					require.NoError(t, os.WriteFile(victim, []byte("untouched"), 0o644))
+					link = "victim"
+				}
+				ok := okPipeline().Complete
+				calls := 0
+				cfg := Config{BrainDir: brainDir, Interval: time.Hour, Pipeline: pipeline.Config{Schema: "# Schema",
+					Complete: func(ctx context.Context, sys, user string) (string, error) {
+						calls++
+						require.NoError(t, os.Symlink(link, marker))
+						if kind == "failed" {
+							return "", errors.New("model down")
+						}
+						return ok(ctx, sys, user)
+					}}}
+				for i := 0; i < 3; i++ {
+					errs := processDir(context.Background(), cfg, "2026-10-05")
+					if i == 0 {
+						require.NotEmpty(t, errs, "the planted link was not refused")
+					}
+					_ = os.Remove(marker)
+				}
+				assert.Equal(t, 1, calls, "the note was retried after its marker write was refused")
+				if target == "in-brain" {
+					got, err := os.ReadFile(victim)
+					require.NoError(t, err)
+					assert.Equal(t, "untouched", string(got), "the marker was written through the link")
+				} else {
+					_, err := os.Lstat(link)
+					assert.True(t, os.IsNotExist(err), "the marker was written through the link")
+				}
+			})
+		}
+	}
+}
+
+// A refused archive copy must not retry every interval: the note is
+// remembered and skipped until it changes (a symlinked raw/failed cost one
+// LLM call per round before).
+func TestProcessDirDoesNotRetryANoteWhoseArchiveCopyIsRefused(t *testing.T) {
+	brainDir := setupBrainDir(t)
+	require.NoError(t, os.WriteFile(filepath.Join(brainDir, "raw", "n.md"), []byte("note"), 0o644))
+	require.NoError(t, os.Symlink(t.TempDir(), filepath.Join(brainDir, "raw", "failed")))
+	calls := 0
+	cfg := Config{BrainDir: brainDir, Interval: time.Hour, Pipeline: pipeline.Config{
+		Complete: func(context.Context, string, string) (string, error) { calls++; return "", errors.New("model down") }, Schema: "# Schema"}}
+	for i := 0; i < 3; i++ {
+		_ = processDir(context.Background(), cfg, "2026-10-05")
+	}
+	assert.Equal(t, 1, calls, "the refused note was retried every round")
+
+	// Once the note changes it is tried again.
+	require.NoError(t, os.WriteFile(filepath.Join(brainDir, "raw", "n.md"), []byte("note, edited"), 0o644))
+	future := time.Now().Add(2 * time.Second)
+	require.NoError(t, os.Chtimes(filepath.Join(brainDir, "raw", "n.md"), future, future))
+	_ = processDir(context.Background(), cfg, "2026-10-05")
+	assert.Equal(t, 2, calls, "positive control: a changed note is tried again")
+}
+
+// A note whose name has a backslash is legal on Linux and must be processed
+// (cleanRel refused it, so it was never archived or marked).
+func TestProcessDirProcessesANoteWithABackslashInItsName(t *testing.T) {
+	brainDir := setupBrainDir(t)
+	require.NoError(t, os.WriteFile(filepath.Join(brainDir, "raw", "a\\b.md"), []byte("note"), 0o644))
+	errs := processDir(context.Background(), Config{BrainDir: brainDir, Interval: time.Hour, Pipeline: okPipeline()}, "2026-10-05")
+	assert.Empty(t, errs)
+	_, err := os.Stat(filepath.Join(brainDir, "raw", "a\\b.md.processed"))
+	assert.NoError(t, err)
+}