Feature: warn when the same session name resolves to different mailboxes across git worktrees (silent message loss)

[ohade]

I hit a silent footgun with git worktrees. AM_ROOT resolves relative to cwd (.agent-mail/<session>), so two agents using the same session name from different worktrees of the same repo land in different mailbox trees. The result is that amq who shows the peer as stale, and amq send drops into a mailbox the peer never reads, so delivery silently fails and the drained receipt just times out. It took me a while to realize the messages were going to a different tree entirely.

Two ideas, either one would help:

1. An opt-in mode to anchor the root at the repo's common git dir (git rev-parse --git-common-dir) so all worktrees of one repo share one mailbox. I'd keep per-worktree isolation as the default, since running separate agent teams per feature branch is legitimately useful.

2. A divergence warning: when sending to a peer on session X, if that peer's most recent presence for session X is under a different resolved root, warn instead of silently queuing to a dead mailbox.

The warning alone would have saved me a couple of hours here. Thoughts on whether either fits the model you have in mind?

[avivsinai]

Valid report — and timely: this is the same family as a relative-root bug we just fixed in #204 (roots re-resolving against cwd). Your two ideas separate into "share one mailbox across worktrees" and "detect an accidental split", and they get different treatments:

Sharing a root across worktrees already works today — .amqrc accepts an absolute root path, and AM_ROOT/AMQ_GLOBAL_ROOT exist for env-level pinning. So rather than a new git-common-dir mode (another config dimension), we'll document the absolute-root pattern for worktree users. Per-worktree isolation stays the default, as you suggested.

Divergence detection: agreed AMQ should fail louder, but not in send. The send path is filesystem/config-based and git-unaware by design; making every send shell out to git is the wrong layer. The plan instead: a doctor --ops check — best-effort, fail-open — that enumerates sibling worktrees (git worktree list --porcelain), flags when the same session name resolves to multiple roots with fresher peer presence in another tree, and names both roots. Plus a cheap hint when send --wait-for times out, pointing at doctor --ops, and a local hint when the root is worktree-relative.

Tracking both (docs + doctor check) as follow-ups.

[avivsinai]

Resolved in two landed layers. PR #204 (dbaec17d8edd68f9779d28c1b0e896c1f270d2a1) pins coop/env roots absolutely so they do not re-resolve as cwd changes. Issue #207 was closed by PR #228 (db99e78f7fccd414dccc5199fde8ac3685ae9a58), which adds doctor --ops worktree-divergence diagnostics, clearer delivery-timeout context, and the absolute shared-root documentation. Per-worktree isolation remains the default; configuring the same absolute root is the supported sharing mechanism.