broker: resolve <parent> sentinel to topology parent at send time (#692)

docs/conventions.md

@@ -21,6 +21,29 @@ bind-mount." A sub-agent only sees its own `/run/hive/mcp.sock`; the
 manager has access to its privileged socket; hive-c0re owns the host
 admin socket.
 
+## Recipient sentinels
+
+A few recipient names are reserved by the broker and have special
+meaning that ordinary agent labels can never collide with — agent
+name validation rejects any character outside `[a-z0-9_-]`, so the
+angle-bracket and asterisk shapes below are structurally safe.
+
+- `*` — broadcast: deliver to every running agent except the sender
+  (`agent_server::handle_send` fans out via `Coordinator::broadcast_send`).
+- `operator` — the human at the dashboard. Messages accumulate in the
+  inbox view; no agent ever `recv`'s them.
+- `<parent>` — the sender's parent per `topology.json` (`#692`).
+  Rewritten at send time by `topology::resolve_recipient`: looks up
+  `parent_of(sender)` and falls back to `operator` when the sender is
+  a root agent (or absent from topology entirely). Lets agents address
+  their parent without learning the label, so runtime reparenting
+  (`#486`) propagates with zero agent-side restart.
+
+When the resolver rewrites `<parent>`, the broker stores the
+*resolved* label as the message's recipient — the dashboard and
+recv side both see the real route. The sentinel is purely a
+send-time addressing convenience.
+
 ## Wire protocol
 
 JSON line-delimited over unix sockets in both directions (host admin