fix(coord): anchor alloc.ps1, claim.ps1 and setup-leak-gate.ps1 to their own checkout (BACKLOG #1060, #1063)

docs/BACKLOG.md

@@ -5539,10 +5539,14 @@ The literal spellings are all caught, including the newline form. Only the indir
 
 ## 1060. `alloc.ps1` records the owning worktree from the current directory, so an absolute-path invocation misattributes it
 
-> 🔢 **Filed 2026-08-05 — not started.** Value **5/10** · Difficulty **2/10** · _quick win_. `scripts/coord/alloc.ps1:51` takes the owner from `git rev-parse --show-toplevel`, which resolves against the **current directory** rather than the script's location. Invoke it by absolute `-File` path from a different worktree — which is how a session with several worktrees naturally calls it — and the allocation is recorded to the caller's worktree while the commit comes from another. The ledger gate then refuses that commit correctly, but far away from the cause and with a message about the wrong thing.
+> ✅ **SHIPPED 2026-08-06 — every `git` call in both allocators is anchored to the script's own checkout, and the defect was larger than filed.** Value **5/10** · Difficulty **2/10** · _quick win_. `$repo` now comes from `git -C $PSScriptRoot rev-parse --path-format=absolute --show-toplevel`, and every subsequent call takes `-C $repo`. **`git -C`, not `Split-Path`:** the recorded `worktree` value is *compared* — by `ledger_check.py:227` and by `-List` — so its string form is part of a contract, and `--path-format=absolute` keeps writing the forward-slash form every claim already on disk carries. **The filing named one of four cwd-derived reads.** Also wrong, and measured on the pre-fix code: the `$branch` recorded with the claim was the *caller's* branch; the floor's boundary was parsed from the **caller's** `scripts/hooks/ledger_check.py`; and the floor's working-tree term — the one whose job is to catch a number written but committed **nowhere** — read the **caller's** `docs/BACKLOG.md`. That last one is not friction: a number drafted in the target worktree was invisible to the sweep and free to re-issue, which is the collision this script exists to prevent. **`scripts/coord/claim.ps1:54` carried the same construct and was never filed** — found by inspection while fixing this, fixed in the same commit; its enforcing hook `claim_check.py` reads the repo from cwd and is *right* to, because a commit hook's cwd **is** the committing worktree. Hook right, tool wrong, and only the tool can be invoked from elsewhere. The item's cheap second half — printing the recorded worktree at allocation time — was **already built** (`claimed by:`); what was missing is a note when the shell is standing somewhere else, which is now printed. Tested by the **divergence** with `-ShowFloor`, so no numbers were burned: two temp checkouts drafting different numbers, the allocator invoked by absolute path from the other one. The negative control was run, not assumed — reverted, the same test reports `floor : 7777`, `boundary : 1900` and a watermark under `Caller/.git/`, all three signals pointing at the wrong tree. Original filing follows. `scripts/coord/alloc.ps1:51` took the owner from `git rev-parse --show-toplevel`, which resolves against the **current directory** rather than the script's location. Invoke it by absolute `-File` path from a different worktree — which is how a session with several worktrees naturally calls it — and the allocation is recorded to the caller's worktree while the commit comes from another. The ledger gate then refuses that commit correctly, but far away from the cause and with a message about the wrong thing.
 
 **Cluster:** Session coordination / ledger integrity. **Priority:** P3. **Verdict:** build (small). **Severity:** no data loss and no security effect — the ledger gate **fails closed**, which is why this is a friction defect and not a correctness one. Nothing invalid lands; a valid commit is refused.
 
+**SEVERITY CORRECTION, 2026-08-06, made while fixing it.** The paragraph above is right about the *recorded owner* and wrong about the item as a whole, because the filing looked at one line and the defect was in four. The ledger gate does fail closed on a misattributed claim — but the floor's **working-tree term** was cwd-derived too, and that term has no gate behind it. Its job is to see a number written to `docs/BACKLOG.md` and committed **nowhere**; reading the caller's tree makes a number drafted in the *target* worktree invisible, so the allocator hands it out as free and two items end up sharing it in the same tree. Both are then owned by that worktree, so `owns()` passes and the ledger gate never fires. That is the exact silent collision the script's own docstring says it exists to prevent, arrived at through the script. The window is narrow — anything committed on any ref is still caught by the all-refs term — but it is a correctness hole, not friction, and it was reproduced in the negative control rather than reasoned about.
+
+**AND THE FIX CONVERTED TWO SANDBOXED TESTS INTO WRITERS ON THE LIVE REGISTRY, which is the part worth remembering.** `tests/test_coord_claim_{refresh,liveness}.py` ran the **real** `scripts/coord/claim.ps1` with `cwd` set to a temp repo — scoped to a throwaway registry *purely by ambient cwd*, and one of them said so in a docstring: *"it scopes itself to the cwd's repo"*. The moment the script stopped consulting cwd, the passing half of the run wrote real claims into this clone's shared registry (two strays, removed by hand). So a cwd-dependence that looks like a defect in the tool can be load-bearing **isolation** in its tests, and removing it is a change to both. `tests/test_ledger_check.py` already staged a copy of `alloc.ps1` inside its fixture, which is exactly why it was the one file that did not break — the pattern existed and the two claim files were the outliers. Both now stage and commit the script into the fixture, so the sandbox is structural rather than ambient. Anyone fixing the remaining instances of this class (#1057, #1059) should check what their tests are isolated *by* before changing what the code reads.
+
 **Reproduced 2026-08-05, twice, by accident.** A session ran `pwsh -NoProfile -File <abs>/scripts/coord/alloc.ps1 -Kind backlog` from worktree A while intending to commit from worktree B. `alloc/backlog/1058.json` recorded `"worktree": "<...>/trusting-wu-c2e6d5"`. The commit from `MessageFoundry-gate-deferrals` was then refused: *"BACKLOG item #1058 was not allocated to this worktree"* — true, unhelpful, and pointing at the allocator rather than at the invocation. Re-running with the shell actually inside the target worktree produced `1059.json` with the right owner and the commit went through. **#1058 is an abandoned hole**, which is the sanctioned outcome (`alloc.ps1`'s own docstring: *holes are free, collisions are not*).
 
 **The fix is small and there are two defensible shapes.** Either derive the repo from `$PSScriptRoot` so the allocator is anchored to the checkout it lives in — matching what `new.ps1` and `remove.ps1` already do — or keep the cwd behaviour and **say so at the point of use**, printing the recorded worktree in the `ALLOCATED` output so the mismatch is visible immediately rather than at commit time. The second is weaker but nearly free, and the two compose. Prefer anchoring: an allocator invoked by absolute path is being told which checkout to act on, and it should not then consult a different one.
@@ -5615,7 +5619,7 @@ The second step's arithmetic is measured: `GetFullPath('.git', <abs primary>)` r
 
 ## 1063. `setup-leak-gate.ps1` picks the checkout from the current directory, so it can arm a worktree the operator did not name
 
-> 🔢 **Filed 2026-08-06 — not started.** Value **3/10** · Difficulty **1/10** · _quick win_. `scripts/dev/setup-leak-gate.ps1:37` is `$repo = (& git rev-parse --show-toplevel 2>$null)` — no `-C`, no `-Repo` parameter, no `$PSScriptRoot` anchor. Invoked by absolute `-File` path from a different worktree, which is the ordinary shape on a clone with 40-plus of them, it installs the leak-gate token list into **the current directory's** checkout and prints `CONFIGURED` about that one, while the worktree the operator named keeps no token source. Its own directory siblings already do it correctly.
+> ✅ **SHIPPED 2026-08-06 — the root is anchored to the script's own location, and the divergence is under test.** Value **3/10** · Difficulty **1/10** · _quick win_. `$repo` now comes from `Split-Path -Parent (Split-Path -Parent $PSScriptRoot)`, the form `postgres.ps1` and `sqlserver.ps1` in the same directory already use, plus an assert that the derived root actually carries `scripts/security/` — a wrong root should say so at the point of derivation rather than surface later as a confusing scanner failure. Tested by the **divergence**, not the happy path: two temp checkouts that both carry `scripts/security/`, the script invoked by absolute `-File` path while the shell stands in the other one, asserting the token list lands in the checkout holding the script and **not** in the caller's. The pre-fix behaviour was reproduced directly rather than inferred — reverted, the same test reports *"the named checkout was not armed"*. Only the three files the script reaches for are copied into the fixture, never the whole of `scripts/security/`, because a maintainer running the suite has the real token list sitting in that directory. Original filing follows. `scripts/dev/setup-leak-gate.ps1:37` was `$repo = (& git rev-parse --show-toplevel 2>$null)` — no `-C`, no `-Repo` parameter, no `$PSScriptRoot` anchor. Invoked by absolute `-File` path from a different worktree, which is the ordinary shape on a clone with 40-plus of them, it installs the leak-gate token list into **the current directory's** checkout and prints `CONFIGURED` about that one, while the worktree the operator named keeps no token source. Its own directory siblings already do it correctly.
 
 **Cluster:** Developer tooling / configuration anchoring. **Priority:** P4. **Verdict:** build (trivial). **Severity:** **low, and the low severity is load-bearing** — every failure direction here is loud or fail-closed, which is why this is filed at 3 rather than alongside its siblings. Nothing is silently ungated and no wrong authorisation is granted.
 
@@ -5629,7 +5633,7 @@ $repo = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
 
 Anchoring on `$PSScriptRoot` binds the script to the checkout it lives in, which is what an absolute `-File` invocation is asking for. `-From` names the token **source**, not the checkout, so it does not already cover this.
 
-**Same construct as #1060.** `alloc.ps1:51` is byte-equivalent (`git rev-parse --show-toplevel` with no anchor) and produces the same class of wrong answer — there, a misattributed ledger allocation; here, a token list installed into the wrong tree. Fixing them together is reasonable; filing them together was not, because their severities differ by two priority bands and folding this into #1060 would have inflated it.
+**Same construct as #1060.** `alloc.ps1:51` is the same construct — `git rev-parse --show-toplevel` with no anchor — and produces the same class of wrong answer — there, a misattributed ledger allocation; here, a token list installed into the wrong tree. Fixing them together is reasonable; filing them together was not, because their severities differ by two priority bands and folding this into #1060 would have inflated it. (The filing said *byte-equivalent*. It is not: `alloc.ps1` carries `--path-format=absolute` and this script does not. The defect is identical; the bytes are not, and "byte-equivalent" is the kind of claim a later reader greps for and then trusts.)
 
 **How it was found, and why that matters more than the defect.** A repo-wide sweep for the cwd-as-identity shape assigned five surfaces and left `scripts/dev` and `scripts/service` in **no** surface at all — seven `.ps1` files in the seam. This was found only because the synthesising agent went outside its brief and swept the unassigned region. A measuring apparatus with a blind spot, hunting mechanisms with blind spots. Worth remembering when the next sweep is designed: **state the unassigned regions, or the result reads as completeness.**
 

scripts/coord/alloc.ps1

@@ -48,9 +48,27 @@ param(
 
 $ErrorActionPreference = "Stop"
 
-$repo = (& git rev-parse --path-format=absolute --show-toplevel).Trim()
-if (-not $repo) { throw "Not inside a git repository." }
-$common = (& git rev-parse --path-format=absolute --git-common-dir).Trim()
+# ANCHOR ON THE SCRIPT, NOT ON THE CURRENT DIRECTORY (BACKLOG #1060). Unanchored, every `git` call below
+# resolved against wherever the shell happened to be standing, so an absolute `-File` invocation from
+# worktree A while intending to commit from worktree B recorded the claim to A. The ledger gate then
+# refused B's commit -- correctly, fails closed, nothing invalid lands -- but far from the cause and with
+# a message about the wrong thing. It also cost a number: holes are free, collisions are not.
+#
+# `git -C $PSScriptRoot` rather than `Split-Path`, which is what the sibling scripts in scripts/dev use.
+# The recorded `worktree` value is COMPARED, by ledger_check.py:227 and by -List below, so its string form
+# is part of a contract: `--path-format=absolute` returns the forward-slash absolute form every claim
+# already on disk carries, and `Split-Path` would start writing backslashes into the same field. Both
+# comparisons normalise separators today, so this is not a live break -- it is a field whose format
+# nothing pins, and changing it for no reason is how the next reader's grep stops matching.
+#
+# Every `git` call in this file is anchored the same way for the same reason. The floor's working-tree
+# term (below) is the one where an unanchored read is more than misattribution: it looks for numbers
+# written but committed NOWHERE, so reading the caller's tree makes a number drafted in the TARGET tree
+# invisible and free to re-issue -- the collision this whole script exists to prevent.
+$repo = (& git -C $PSScriptRoot rev-parse --path-format=absolute --show-toplevel 2>$null)
+if (-not $repo) { throw "scripts/coord/ is not inside a git repository: $PSScriptRoot" }
+$repo = $repo.Trim()
+$common = (& git -C $repo rev-parse --path-format=absolute --git-common-dir).Trim()
 $allocRoot = Join-Path $common "mefor-coord/alloc"
 $alloc = Join-Path $allocRoot $Kind
 New-Item -ItemType Directory -Force -Path $alloc | Out-Null
@@ -72,8 +90,8 @@ if (-not $Title -and -not $ShowFloor) { throw "-Title is required (it is recorde
 
 # `git branch --show-current` prints NOTHING on a detached HEAD, so `& git ...` yields $null (not "")
 # -- calling .Trim() on it here threw *before* the detached-HEAD fallback below could run. Null-check first.
-$branch = & git branch --show-current
-if ([string]::IsNullOrWhiteSpace($branch)) { $branch = "detached@" + (& git rev-parse --short HEAD) }
+$branch = & git -C $repo branch --show-current
+if ([string]::IsNullOrWhiteSpace($branch)) { $branch = "detached@" + (& git -C $repo rev-parse --short HEAD) }
 $branch = $branch.Trim()
 
 # FLOOR = max over (origin/main) U (every local + remote ref) U (existing allocations).
@@ -88,9 +106,9 @@ function Get-Floor {
     $seen.Add(0)
 
     if ($Kind -eq "adr") {
-        $refs = @("origin/main") + @(& git for-each-ref --format='%(refname)' refs/heads refs/remotes)
+        $refs = @("origin/main") + @(& git -C $repo for-each-ref --format='%(refname)' refs/heads refs/remotes)
         foreach ($ref in ($refs | Select-Object -Unique)) {
-            $names = & git ls-tree --name-only $ref docs/adr/ 2>$null
+            $names = & git -C $repo ls-tree --name-only $ref docs/adr/ 2>$null
             foreach ($n in $names) {
                 if ($n -match 'docs/adr/(\d{4})-') { $seen.Add([int]$Matches[1]) }
             }
@@ -117,13 +135,13 @@ function Get-Floor {
         # files means adding each one here; an archive file not listed here is not policed.
         $backlogPaths = @("docs/BACKLOG.md", "docs/archive/backlog/BACKLOG-CLOSED.md")
 
-        $refs = @("origin/main", "HEAD") + @(& git for-each-ref --format='%(refname)' refs/heads refs/remotes)
+        $refs = @("origin/main", "HEAD") + @(& git -C $repo for-each-ref --format='%(refname)' refs/heads refs/remotes)
         $specs = foreach ($r in ($refs | Select-Object -Unique)) {
             foreach ($p in $backlogPaths) { "${r}:${p}" }
         }
 
         $oids = [System.Collections.Generic.HashSet[string]]::new()
-        foreach ($line in ($specs -join "`n" | & git cat-file --batch-check='%(objectname) %(objecttype)' 2>$null)) {
+        foreach ($line in ($specs -join "`n" | & git -C $repo cat-file --batch-check='%(objectname) %(objecttype)' 2>$null)) {
             $p = "$line".Split(' ')
             if ($p.Count -ge 2 -and $p[1] -eq 'blob') { [void]$oids.Add($p[0]) }
         }
@@ -138,7 +156,7 @@ function Get-Floor {
         # that had been committed somewhere -- i.e. every case except the one this term is for.
         $rx = [regex]::new('^#{2,3} (\d+)\.', [System.Text.RegularExpressions.RegexOptions]::Multiline)
         if ($oids.Count -gt 0) {
-            foreach ($line in (($oids -join "`n") | & git cat-file --batch 2>$null)) {
+            foreach ($line in (($oids -join "`n") | & git -C $repo cat-file --batch 2>$null)) {
                 $m = $rx.Match("$line")
                 if ($m.Success) { $seen.Add([int]$m.Groups[1].Value) }
             }
@@ -410,6 +428,23 @@ for ($i = $start; $i -lt $start + 500; $i++) {
         Write-Host "  file    : docs/BACKLOG.md"
     }
     Write-Host "  claimed by: $repo [$branch]"
+
+    # SAY IT AT THE POINT OF USE when the shell is standing somewhere else (BACKLOG #1060). Anchoring is
+    # now correct, but it is also SURPRISING: a caller who runs this by absolute path from worktree A gets
+    # a claim recorded to worktree B, and the only other place that fact surfaces is the ledger gate
+    # refusing a commit later, elsewhere, with a message about the wrong thing. One line here turns a
+    # deferred, misdirected refusal into an immediate, accurate note. Silent on the ordinary same-tree
+    # invocation, so it stays worth reading.
+    $cwdTop = (& git rev-parse --path-format=absolute --show-toplevel 2>$null)
+    if ($cwdTop) {
+        $a = ($cwdTop.Trim() -replace '\\', '/').TrimEnd('/')
+        $b = ($repo -replace '\\', '/').TrimEnd('/')
+        if ($a -ine $b) {
+            Write-Host "  NOTE: your shell is in $a, but this allocator lives in $b, so the claim is recorded" -ForegroundColor Yellow
+            Write-Host "        to $b. COMMIT FROM THERE -- the ledger gate keys entitlement on the worktree" -ForegroundColor Yellow
+            Write-Host "        named above and will refuse the commit anywhere else." -ForegroundColor Yellow
+        }
+    }
     exit 0
 }