fix(engine)!: identity is derived, never invented

Four defects that all reduce to the same thing: the engine trusted a name it
had no business trusting.

_broadcast is now a reserved namespace, not a repo. coord-send guarded
retraction with a sender check, but that guard only covered the door it was
nailed to: `coord-done --repo _broadcast <file>` walked in the side entrance
and archived a broadcast out of the queue - a full unauthenticated retract of
an announcement for every repo that had not read it yet. The rule reserves the
whole `_` prefix rather than one literal, so a later `_seen` or `_config`
cannot reopen the hole, and it is enforced in every CLI: a rule held in three
of four places is not a rule.

The pwd fallback is gone. It existed so the CLI would work anywhere, but
"anywhere" includes every global surface: a session in ~/repos is not a repo,
and basename(pwd) silently handed it the identity "repos". That is not
hypothetical - mail was delivered under exactly that name. git toplevel or an
explicit --from/--repo are now the only two sources. The write paths refuse
and say so; the read path declines silently, because the hook runs it at every
session start and must never fail a session.

Two checkouts with the same directory name still share one mailbox - re-keying
identity would break every existing mailbox and the readable `--to <repo>`
addressing. Instead the first git-derived read records the claiming path in
<repo>/.origin, and a read from elsewhere is warned about in the injection. A
warning, not a refusal: the same repo moved or re-cloned is the ordinary case.
The warning goes in the injection because the hook discards stderr, and a
warning nobody can see is not a warning. The collision is live in this tree:
claude-code-100x is nested inside a repo of the same name.

Broadcast delivery is recorded only after the injection is written. Marking
inside the read loop left a window where the seen set said "delivered" while
the operator saw nothing, and the hook runs under `timeout: 10`, so the window
was reachable. A lost broadcast is unrecoverable by design - the seen set is
delivery history and retraction deliberately leaves it alone - so the failure
mode has to be redelivery, never loss.

The hook stops resolving identity altogether. It was the fourth copy of the
rule and the only one that runs in production, so passing --repo bypassed the
engine's guards exactly where they mattered and suppressed the collision check
along with them. It is now the pure wrapper the boundary rule always claimed
it was, pinned by two behavioral tests rather than by reading the source.

Selftest 93 -> 116; three node tests cover the hook.

BREAKING CHANGE: coord-send and coord-done exit 2 outside a git repo instead
of naming themselves after the working directory. Pass --from/--repo to choose
an identity explicitly. Repo names beginning with _ are refused everywhere.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U6EixQo6hpoRCVtiAXdnFs

scripts/coord-send.sh

@@ -45,11 +45,24 @@ while [ $# -gt 0 ]; do
 done
 
 # --- Resolve sender / self identity ---
+# git toplevel or an explicit --from, and nothing else. basename(pwd) used to
+# be the last resort, but every global surface (~/repos, $HOME) is a directory
+# without a repo, and the fallback quietly handed one an identity like "repos" -
+# a real message was delivered under exactly that name. An invented identity is
+# worse than none: it signs mail as a repo that does not exist and, on the read
+# side, opens a mailbox that may belong to someone else. Refuse and say how.
 if [ -z "$FROM" ]; then
   FROM="$(basename "$(git rev-parse --show-toplevel 2>/dev/null)" 2>/dev/null)"
-  [ -z "$FROM" ] && FROM="$(basename "$(pwd)" 2>/dev/null)"
 fi
-[ -z "$FROM" ] && FROM="unknown"
+if [ -z "$FROM" ]; then
+  echo "coord-send: cannot resolve sender identity (not inside a git repo); pass --from <repo> to choose one explicitly" >&2
+  exit 2
+fi
+# A leading _ is reserved for engine internals (_broadcast today; the rule
+# reserves the namespace so a later _seen or _config cannot reopen the hole).
+case "$FROM" in
+  _*) echo "coord-send: invalid sender identity: $FROM (names starting with _ are reserved for the engine)" >&2; exit 2 ;;
+esac
 
 # Frontmatter is line-oriented: a CR/LF inside a field would inject extra
 # frontmatter lines or a premature '---' terminator. Collapse newlines to
@@ -126,8 +139,10 @@ if [ "$BROADCAST" -eq 0 ] && [ -z "$TO" ]; then
   echo "coord-send: missing --to <repo> / --broadcast / --reply-to" >&2; exit 2
 fi
 if [ "$BROADCAST" -eq 0 ]; then
+  # _* rather than the single literal _broadcast: the reserved namespace is a
+  # rule, so a future internal directory is covered the day it is added.
   case "$TO" in
-    */*|.*|_broadcast) echo "coord-send: invalid target repo name: $TO" >&2; exit 2 ;;
+    */*|.*|_*) echo "coord-send: invalid target repo name: $TO" >&2; exit 2 ;;
   esac
 fi
 if [ -z "$SUBJECT" ]; then