chore(release): v0.6.0

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U6EixQo6hpoRCVtiAXdnFs

CHANGELOG.md

@@ -5,6 +5,57 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.0] - 2026-07-26
+
+### Fixed
+
+- **`_broadcast` is a reserved namespace, not a repo.** `coord-send` guarded
+  retraction with a sender check, but that guard only covered the door it was
+  nailed to: `coord-done --repo _broadcast <file>` archived a broadcast out of
+  the queue — a full unauthenticated retract of an announcement for every repo
+  that had not read it yet. The whole `_` prefix is now reserved, in every CLI,
+  so a later `_seen` or `_config` cannot reopen the hole.
+- **Repo identity is derived, never invented.** The fallback to
+  `basename(pwd)` is gone. It existed so the CLI would work anywhere, but
+  "anywhere" includes every global surface: a session in `~/repos` is not a
+  repo, and the fallback silently handed it the identity `repos` — under which
+  real mail was delivered. git toplevel or an explicit `--from`/`--repo` are
+  now the only sources. Write paths exit 2 and name the fix; the read path
+  declines silently, because the hook runs at every session start and must
+  never fail a session.
+- **Broadcast delivery is recorded only after the injection is written.**
+  Marking inside the read loop left a window where the seen set said
+  "delivered" while the operator saw nothing — and the hook runs under
+  `timeout: 10`, so the window was reachable. A lost broadcast is
+  unrecoverable by design (the seen set is delivery history, and retraction
+  deliberately leaves it alone), so the failure mode is now redelivery.
+- **The hook no longer resolves identity at all.** It was a fourth independent
+  copy of the identity rule and the only one that runs in production, so
+  passing `--repo` bypassed the engine's guards exactly where they mattered —
+  and suppressed the new collision check along with them.
+
+### Added
+
+- **Mailbox-collision warning.** Two checkouts with the same directory name
+  share one mailbox. Re-keying identity would break every existing mailbox and
+  the readable `--to <repo>` addressing, so the first git-derived read records
+  the claiming path in `<repo>/.origin`, and a read from a different path is
+  reported in the injection. A warning, not a refusal: the same repo moved or
+  re-cloned is the ordinary case. It goes in the injection because the hook
+  discards stderr, and a warning nobody can see is not a warning.
+
+### Changed
+
+- Selftest 93 → 116 checks; three Node tests now cover the hook behaviorally
+  rather than by reading its source.
+
+### Breaking
+
+- `coord-send` and `coord-done` exit 2 outside a git repository instead of
+  naming themselves after the working directory. Pass `--from`/`--repo` to
+  choose an identity explicitly. Repo names beginning with `_` are refused
+  everywhere.
+
 ## [0.5.0] - 2026-07-25
 
 ### Changed