os.Root refuses links that leave the brain on its own, so the slice 1-3 callers' outside-target tests stayed green when a caller read without brainfs's Lstat/SameFile checks (PR #168 round-2 review). Adds a static in-brain link (wiki/w/facts/inlink.md -> ../../../raw/s.md) and an AssertNoLeakFrom swap race with an in-brain target for search.Query, hydrate, vectorstore.Sync, readExcerpt and api.ReadNote. Flip-verified: replacing each caller's bfs.ReadRegular with an os.OpenRoot(brainDir).ReadFile turns every one red on the new assertions (Query, hydrate, Sync, readExcerpt, ReadNote). Also from that review: rename TestReadRegularNever... to ...DoesNotReturn... (rule 9: a sampled race), and AssertNoLeakFrom's failure message names the symlink target instead of 'outside file'. Closes #171 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>