fix(coord-send): reply mode claimed "marked handled" without checking

coord-send.sh ran coord-done under `>/dev/null 2>&1` and then printed the
handled claim unconditionally. Measured with a stub coord-done exiting 1:
the original stayed in the inbox, no archive/ was created, and coord-send
still exited 0 saying "marked handled" - a false success in the message
transport itself, which is why every reply had to be verified by hand.

The predicate is deliberately wider than the exit code: coord-done exits 0
when it archives nothing (an unknown name is idempotently fine by its own
contract), so an exit-code-only fix still certifies a message that never
moved. The check is exit 0 AND the original no longer being at
$COORD/$FROM/inbox/$REPLYTO - recomputed rather than reusing $REPLY_ORIG,
which resolves to the inbox OR the archive, so replying to an already
archived original moves nothing and must not warn.

Failure is exit 1, a new status: the reply WAS delivered and re-sending it
would duplicate it, so 2 stays the nothing-was-written status.

Selftest section 34 (14 checks, red first) pins all four cases: coord-done
fails outright, coord-done exits 0 without moving, the real happy path, and
an archive-path reply. coord-selftest 206 -> 220.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ett8uHMDLir6trFaMzrYRu

scripts/coord-send.sh

@@ -23,7 +23,9 @@
 #   recall - repos that already received it are unaffected.
 # --from overrides the sender/self identity (default: basename of git toplevel/cwd).
 #
-# Exit: 0 delivered, 2 usage/IO error. ASCII only, bash 3.2 safe.
+# Exit: 0 delivered, 1 delivered but --reply-to's original could NOT be closed
+#   (the reply is sent; do not re-send it, close the original by hand),
+#   2 usage/IO error, nothing written. ASCII only, bash 3.2 safe.
 set -u
 export LC_ALL=C
 
@@ -246,8 +248,38 @@ if [ "$BROADCAST" -eq 1 ]; then
 fi
 
 # --- Reply mode: mark the original handled ---
+# The handled claim is asserted against GROUND TRUTH - is the original still
+# pending in the inbox - and not against the call having been made. It used to
+# print unconditionally with coord-done's output discarded, which made the one
+# line a session relies on to close a reply debt false at the moment it was
+# printed (review finding 9, 2026-08-14: stub coord-done exiting 1, original
+# untouched, no archive/, and coord-send still exited 0 saying "marked
+# handled"). A false success in the transport is worse than a loud failure:
+# every reply had to be verified by hand afterwards, so the exit code carried
+# no information at all.
+#
+# CHECKING THE EXIT CODE ALONE IS NOT ENOUGH, and this is the half a later
+# session is most likely to simplify away. coord-done exits 0 when it archives
+# NOTHING - an unknown name is idempotently fine by its own contract
+# (coord-done.sh:54, :70) - so a nonzero-exit test still certifies a message
+# that never moved. Selftest section 34(b) is that exact case.
+#
+# The path is recomputed rather than reusing $REPLY_ORIG, which resolves to the
+# inbox OR the archive (:129-130). Replying to an already-archived original is
+# legitimate and moves nothing; testing $REPLY_ORIG would warn on every one of
+# those (section 34(d)).
+#
+# Exit 1, not 2: the reply WAS delivered and re-sending it would duplicate it.
+# The distinct status says "delivered, original not closed" - 2 stays the
+# nothing-was-written status it has always been.
 if [ -n "$REPLY_ORIG" ]; then
   "$(dirname "$0")/coord-done.sh" --repo "$FROM" "$REPLYTO" >/dev/null 2>&1
-  echo "coord-send: original ($REPLYTO) marked handled"
+  DONE_RC=$?
+  if [ "$DONE_RC" -eq 0 ] && [ ! -e "$COORD/$FROM/inbox/$REPLYTO" ]; then
+    echo "coord-send: original ($REPLYTO) marked handled"
+  else
+    echo "coord-send: the reply was delivered, but the original ($REPLYTO) is STILL PENDING in $FROM's inbox (coord-done exit $DONE_RC) - it is NOT handled; close it by hand: coord-done $REPLYTO" >&2
+    exit 1
+  fi
 fi
 exit 0