fix(quickfiler): normalize rooted breadcrumb selection paths

.claude/agent-memory/atomic-executor/MEMORY.md

@@ -4,6 +4,7 @@
 - [Blocked Bash command drops chained check-off](project_blocked_bash_command_silently_drops_chained_checkoff.md) — aborts the WHOLE
 - [CSharpier chain-wrap defeats single-line search gates](project_csharpier_chain_wrap_defeats_singleline_search_gates.md) — zero-hit gate go
 - [Verify line citations with numbered output](feedback_verify_line_citations_with_numbered_output.md) — never hand-count
+- [Planner and executor observe different worktrees](project_planner_and_executor_observe_different_worktrees.md) — `git status` claims don't travel
 - [Extract gate literals from the plan, never re-type](project_preflight_gate_literal_extract_from_plan_not_retype.md) — quoting drift
 - [Tool layer collapses `\` in file content](project_tool_layer_collapses_double_backslash_in_file_content.md) — heredocs and Wri
 - [Self-derived gate thresholds are blind](project_preflight_selfderived_gate_thresholds_are_blind.md) — floor from the r

.claude/agent-memory/atomic-executor/project_planner_and_executor_observe_different_worktrees.md

@@ -0,0 +1,33 @@
+---
+name: planner-and-executor-observe-different-worktrees
+description: A plan's claim about worktree-local git state (untracked siblings, dirty files, clean status) can be true in the planner's worktree and false in the executor's; always re-derive it in the executor's checkout
+metadata:
+  type: project
+---
+
+A plan assertion about **worktree-local** git state — "sibling folder X is untracked in this
+checkout", "the tree is dirty", "path Y is not in the index" — is worktree-scoped, and the planner
+and the executor frequently run in different worktrees. `atomic-planner` often runs in the session
+worktree (`TaskMaster-wt/<ts>`), while `atomic-executor` runs in an isolated agent worktree
+(`.claude/worktrees/agent-<id>`) on a different branch. The same path can be untracked in one and
+committed in the other.
+
+**Why:** on #637 round 2 the planner "corrected" a round-1 statement that no sibling folder under
+`docs/features/active` was untracked, replacing it with an explicit claim that the `...-440` folder
+"exists on disk ... and is reported as untracked by `git status --porcelain`". That was true in the
+session worktree and false in the executor's: there `git ls-files` lists the 440 folder's files and
+`git status --porcelain` is completely empty. A correct claim was reversed into a false one, and the
+false claim was then propagated into a task body (`P8-T33`). This is the
+[[project_preflight_citation_match_propagates_false_fact]] failure mode with a worktree twist: the
+planner's observation was real, just about the wrong tree.
+
+**How to apply:** distinguish two claim classes when reviewing.
+- *Commit-scoped* claims (`git diff BASE..HEAD`, `git ls-files`, file contents at a ref) are branch
+  properties and travel with the branch — verify once.
+- *Worktree-scoped* claims (`git status --porcelain`, untracked-file existence, on-disk-but-not-in-index)
+  do NOT travel — re-derive them in the executor's cwd before accepting or contradicting them.
+
+Prefer plan prose that justifies pathspec scoping **prospectively** ("a concurrent run can leave an
+untracked sibling before this task executes") over prose that asserts a specific present-tense tree
+state, because the prospective form is worktree-neutral and cannot go stale between planning and
+execution.

.claude/agent-memory/atomic-planner/MEMORY.md

@@ -19,6 +19,8 @@
 - [#677 R1–R8](project_677_keyboard_focus_leak_plan_seams.md) — ctor param REJECTED (5 reflection-arity tests); typed harness for compile-red; internal 9-arg ctor, never ambient SetSynchronizationContext; per-file non-vacuity floors
 - [#635](project_635_reflective_caller_audit_plan_seams.md) — evidence-only audit: tracked plan inflates its own sweep; scan hits its own pattern list; spec said six sites, tree has eight; pathspec breadth inflates a count
 - [#440 R1–R4](project_440_breadcrumb_left_arrow_plan_seams.md) — deletion-only change voids a diff-derived changed-line gate; `(Rebuild target(s))`, NOT `(Rebuild target)`; `.csharpierignore` matches the `.cobertura.xml` suffix; `.dotnet-sdk` IS gitignored (`.gitignore:350`); cite an AC by sentence only after counting its sentences; `Include` resolves against the declaring project's dir
+- [#637 R6](project_637_r6_superseded_spec_claim_seams.md) — plan narrates spec edits it never performs; delta's stale-site list short by 3 (P1-T7 demanded a falsehood); wrapper throws on 2 conditions; Cobertura node-free lines; repo-wide format drift outside the staged pathspec
+- [#637 R2–R5](project_637_selectrow_rooted_path_plan_seams.md) — `docs/features/active` operand hits 121 sibling evidence files; the untracked-440 claim was FALSE for the agent worktree; blanket `-F` breaks every regex; pre-format range consumed post-format; probe with no branch for the outcome that occurs; set-difference file named by recency; R5 re-anchor on the merge commit, `#NNN` at column 0, CRLF round-trip check
 - [#469 R1–R3](project_469_comment_accuracy_plan_seams.md) — defect-number SWAP voids whole-file token gates; `- [x] AC1` is a prefix of `AC10`; unconditional base-merge task; Phase 0 insert renumbers artifact FILENAMES; pre-edit vs post-edit table cited wrong; evidence dir rule ≠ recorded path form
 - [#644](project_644_ac16_referral_revision_seams.md) — AC's named instrument prints no figure; substitute's noise (~0.028pp) exceeds the 0.01pp delta; check-off task → referral task pinning the UNCHECKED state
 - [#644 cycle 2](project_644_cycle2_sweep_gate_evasion_seams.md) — rewording out of a detector's match set is gate evasion; SHA-256 pair for untracked prior artifacts; bound the porcelain `??` scope
@@ -52,6 +54,7 @@
 - [Enumeration variable must match its consumer](enumeration-variable-must-match-consumer.md) — `$kept` produced vs `@assemblies` splatted = zero-assembly vstest run reporting zero failures
 - [Diff gates need a commit task](diff-gates-need-a-commit-task.md) — `git diff <BASE>..HEAD` passes vacuously with no commit task
 - [Never pin a HEAD SHA as a plan expectation](never-pin-head-sha-as-plan-expectation.md) — gate on tree invariants instead
+- [Harness gitStatus may describe another worktree](harness-git-status-may-describe-another-worktree.md) — measure inside the target worktree (index grep + negative control) or mark the fact unverified
 - [Absolute counts in shared files go stale](absolute-counts-in-shared-files-go-stale.md) — lower-bound/baseline-relative for co-owned files; keep exact the count the task changes
 - [.claude/agent-memory is tracked](agent-memory-is-tracked-scope-git-gates.md) — scope every diff/status/grep gate or it is unsatisfiable
 - [Stale build output is not evidence of existence](stale-build-output-is-not-evidence-of-existence.md) — verify with `git ls-files`, not `obj/`

.claude/agent-memory/atomic-planner/harness-git-status-may-describe-another-worktree.md

@@ -0,0 +1,30 @@
+---
+name: harness-git-status-may-describe-another-worktree
+description: The gitStatus block supplied at session start can describe a different checkout than the agent worktree a plan targets; never quote it as a fact about the target worktree.
+metadata:
+  type: feedback
+---
+
+Never cite the harness-supplied `gitStatus` block as an environment fact about the worktree a plan
+targets. Measure inside the target path, or mark the fact unverified.
+
+**Why:** on issue #637 the harness status described the session worktree
+`TaskMaster-wt/2026-08-29T00-11`, where `docs/features/active/2026-08-07-...-440` was untracked. The
+plan targeted the agent worktree `.claude/worktrees/agent-a68051a23e4479267`, where the same folder is
+tracked — it had merged to `main` at the branch base commit. A preflight reviewer's contrary judgment
+("every sibling folder is committed and clean") was correct and was overruled on the strength of the
+wrong checkout's status. This repository routinely has several worktrees checked out at once, so the
+two states diverge as a matter of course rather than exceptionally.
+
+**How to apply:** before writing any tracked/untracked, dirty/clean, branch or HEAD claim into a plan,
+run the command with `git -C <target worktree>` and observe the output. When no shell tool is
+available in the session, two substitutes are workable and both were used on #637 R3:
+- tracked-ness: grep the target worktree's index for the path literal. Resolve the index via the
+  worktree's `.git` file (`gitdir: <main>/.git/worktrees/<name>`); the index is binary but ripgrep
+  reports a match. Pair every positive probe with a negative control — a path known to be untracked —
+  so a spurious match is detectable. Index membership proves tracked, not unmodified.
+- presence on disk: `Glob`/`Grep` over the path.
+Otherwise state the fact as unverified rather than inferring it. Prefer a justification that does not
+depend on observed tree state at all: an executor runs later than the planning pass, so a
+forward-looking reason ("a concurrent run can create this condition before execution") is both true
+and stable. See [[project_637_selectrow_rooted_path_plan_seams]].

.claude/agent-memory/atomic-planner/project_637_r6_superseded_spec_claim_seams.md

@@ -0,0 +1,75 @@
+---
+name: project-637-r6-superseded-spec-claim-seams
+description: Issue #637 preflight round 6 — a "the spec already carries X" correction leaves the old figure attributed to the corrected criterion at plan sites the delta did not name; plus a two-throw coverage wrapper, Cobertura node-free lines, and repo-wide format drift outside the staged pathspec.
+metadata:
+  type: project
+---
+
+Preflight round-6 seams from the issue #637 atomic plan (breadcrumb `SelectRow` emits a rooted path).
+Complements [[project-637-selectrow-rooted-path-plan-seams]].
+
+**A plan can narrate spec edits it never performs.** Phase 8 of this plan only flips `- [ ]` to
+`- [x]`; no task edits `spec.md` prose. Yet six tasks and one tree-observation block asserted that
+this plan "corrected", "reworded" or "extended" acceptance criteria — corrections a *prior* `spec.md`
+revision had already applied. An executor would have recorded a non-discrepancy under a heading
+asserting a discrepancy.
+**Why:** the plan and the spec were revised in separate rounds; the plan kept the narration of a fix
+whose object had moved into the spec's own history.
+**How to apply:** before writing "this plan corrects AC*n* in `spec.md`", grep the plan for a task
+that actually writes that file. If the only write is a checkbox flip, restate every such claim as a
+verification ("AC*n* already carries X, re-verified against the merged tree") and split the
+reconciliation artifact into an already-corrected list and a still-stale list.
+
+**The delta's own site list will be short.** The round-6 delta named `spec.md:401` and `:414-416` as
+the surviving 424-line sites; the tree also carries 424 at `:582` and `:710`. More importantly, after
+rewriting P8-T25 and tree-observation 1 to say "AC25's parenthetical already reads 485", **three**
+other plan sites still said AC25 states 424 — tree observation 1's own preceding sentence, P1-T7's
+acceptance ("the artifact records that `spec.md`'s implementation table **and AC25** state 424"), and
+P8-T25's own preceding clause. P1-T7's was an acceptance condition demanding the executor record a
+falsehood.
+**How to apply:** after applying any "the spec already carries the corrected figure" edit, grep the
+plan for the OLD numeral and for the criterion's name, and fix every site that still attributes the
+old figure to the corrected criterion. See [[acceptance-edits-must-be-false-before-true-after]].
+
+**`Invoke-MSTestWithCoverage.ps1` throws on two independent conditions.** Non-zero inner vstest exit
+at `Invoke-MSTestWithCoverage.ps1:235-237`, and a repository line rate below 80 at
+`Invoke-MSTestWithCoverage.Helpers.ps1:487-489` (called at `:341`). A clause reading "when the
+baseline failure set is empty, EXIT_CODE 0 and 0 failed are required" is therefore unsatisfiable in
+exactly the state the plan's own `BASELINE BELOW FLOOR` branch exists for. Judge failures and exit
+code separately, keyed on the emitted literal `is below the required 80% threshold.`, and record
+`ExpectedExitCode: 1` on the floor-throw branch.
+Consequence worth stating in the plan: the threshold assertion at `:341` runs BEFORE the
+post-processed write-back at `:343`, so on a floor throw the on-disk Cobertura file is the raw
+dotnet-coverage output. Downstream tasks that re-apply `ConvertTo-KoverageCoberturaXml` in memory are
+unaffected; a task that reads the file expecting post-processed content is not.
+See [[reference-invoke-mstest-with-coverage-script]].
+
+**A mandated literal may legitimately contain `%` or angle brackets.** `is below the required 80%
+threshold.` and `<line>` both trip the wrap-tolerant rule's placeholder character list, so the plan
+gate skips them. They are real emitted literals, not command shapes. Keep them and say so in the
+handoff report rather than substituting a paraphrase that no run emits.
+
+**Cobertura emits a `<line>` node only for a sequence point.** "Every line inside the helper's range
+has non-zero hits" is unsatisfiable, because XML documentation lines, the signature and blank lines
+carry no node and no `hits` attribute. Correct shape: assert over the lines that DO carry a node,
+require the artifact to enumerate and classify the node-free lines, and add "at least one line in the
+range carries a node" so the clause cannot pass vacuously on a range with no coverage rows at all.
+See [[async-state-machine-coverage-aggregation]] for the sibling aggregation trap.
+
+**A repo-wide write-mode formatter plus a narrow staging pathspec hides drift until the final gate.**
+P7-T1 ran `csharpier format .` over the whole repository but observed porcelain only over
+`QuickFiler`, `QuickFiler.Test` and the feature folder; P7-T2 staged only the two QuickFiler trees;
+P8-T30's scope gate spanned nine trees. Pre-existing drift under `UtilitiesCS`, `TaskMaster`,
+`ToDoModel`, `Tags` or `TaskVisualization` would have been repaired, never committed, and would have
+made the final gate unsatisfiable with no earlier detector.
+**How to apply:** the condition is measurable at the read-only baseline — add an
+`OUT_OF_SCOPE_FORMAT_DRIFT:` halt branch to the Phase 0 `csharpier check` task, and give the
+write-mode format task its own porcelain span over exactly the trees its staging pathspec omits.
+See [[repo-wide-csharpier-format-breaks-zero-diff-acs]] and
+[[observation-scope-must-match-blast-radius]].
+
+**An insertion into a non-SDK csproj shifts every later `<Compile Include>` citation.** P2-T6 inserts
+after `QuickFiler.Test/QuickFiler.Test.csproj:64`, so P2-T7's "already registered at `:114`" is stale
+by the time P2-T7 runs (`:115`). Write both values with the event that separates them. Sweep the same
+file's other cited lines (`:116`, `:133`) for acceptance conditions that read them post-insertion —
+here none did.