fix: prevent mixed-version pushy feedback

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a03397-4d51-7fd1-8ff2-946eb22ea2bc

tests/test_broker.py

@@ -19,3 +19,36 @@ def test_broker_accepts_hash_address_alias(tmp_path):
     assert row["sender_repo"] == "net-kingdom"
     assert row["target_repo"] == "railiance-platform"
     assert row["endpoint_id"] == "tmux-amq-42-boot"
+
+
+def test_broker_rejects_legacy_injected_envelope_feedback(tmp_path):
+    store = Store(tmp_path / "queue.sqlite3")
+    message_id = store.add(
+        "flex-auth",
+        "audit-core",
+        "Hello worker agent!",
+        endpoint="tmux-amq-42-boot",
+    )
+    broker = InputBroker(
+        store, BrokerIdentity("tmux-amq-42-boot", "audit-core")
+    )
+
+    assert (
+        broker.inspect_line(
+            f"#flex-auth: Hello worker agent! [{message_id}]"
+        )
+        is None
+    )
+    assert len(store.list()) == 1
+
+
+def test_broker_does_not_block_unknown_receipt_like_user_text(tmp_path):
+    store = Store(tmp_path / "queue.sqlite3")
+    broker = InputBroker(
+        store, BrokerIdentity("tmux-amq-42-boot", "audit-core")
+    )
+
+    assert broker.inspect_line(
+        "#flex-auth: Please inspect [m-00000000-0000-0000-0000-000000000000]"
+    )
+    assert len(store.list()) == 1