---
title: P2 — B-BABYSIT-FIX review hardening — close review-team findings on the 2026-05-21 reliability bundle
status: Refined
filed: 2026-05-21
refined: 2026-05-21
priority: P2
type: bug-hardening
code: R-CCR
related:
  - prds/BUG-REPORT-2026-05-20-b-flake-babysit-session.md
---

# R-CCR — B-BABYSIT-FIX review hardening

## Context

On 2026-05-21 a reliability bundle landed in four commits (`bf89a1a3`, `5501d4ed`,
`be269e03`, `4ec358e3`) closing findings #46/#53/#54/#58-#64. A three-agent
read-only review of that diff, plus three refinement cycles, surfaced robustness
gaps, two correctness leaks, weak exit-code/status semantics, and test-coverage
holes. This PRD turns those into atomic, machine-checkable tickets.

All changes are in `extension/src/` (TypeScript; compiled mirrors in
`extension/bin/` are regenerated by `npx tsc` — never hand-edited). Tests are
`extension/tests/*.test.js` run via `node --test`. HEAD at refinement: `4ec358e3`.

## Handoff stop — end state (single contract for R-CCR-3/4/5/10)

| Field | Value on a clean handoff stop | Verified mechanism |
|---|---|---|
| process exit code | `PipelineRunnerExitCode.Success` (0) | `pipeline-runner.ts:2284` |
| `state.exit_reason` | preserved (`manager_handoff_pending` / `closer_handoff_terminal`) | `finalizePipeline` `finalizeTerminalState({step:'completed'})` already preserves |
| `pipeline-status.json` status | `'completed'` (reused — `state.exit_reason` carries the discriminator; zero `PipelineStatusKind`/`monitor.ts` change) | `pipeline-runner.ts:83`, `:2275` |
| closer-release plan | does NOT run — a handoff is unfinished work | `pipeline-runner.ts:2265` |

## Risks

- **Monitor regression on a new status value** — `PipelineStatusKind` (`pipeline-runner.ts:83`) is a closed union and `monitor.ts` validates against an explicit allow-list (`monitor.ts:647-650`) + terminal check (`:675`). Decision: reuse `'completed'` — zero type change, monitor treats it as terminal. Do NOT introduce `'handoff'`.
- **Silent revert-suppression (R-CCR-1)** — the session-dir fallback can confirm a SHA reachable in the WRONG repo, leaving a genuinely-incomplete ticket Done with no second checkpoint. Mitigation: fall back ONLY when git fails to run (dir missing / not a repo), never on a clean not-ancestor result; AND emit an activity-log entry whenever the fallback fires (AC-CCR-1-3).
- **Closer-release side-effect on handoff** — flipping `pipelineFailed` for R-CCR-4 would re-enable the `if (!pipelineFailed)` closer-release branch. Mitigation: a dedicated `handoffStop` flag; release gate becomes `if (!pipelineFailed && !handoffStop)`.
- **Exit-code contract (R-CCR-4)** — reuse `PipelineRunnerExitCode.Success` (0); add no 5th member (Major bump). `auto-resume.sh` and `claimPipelineRunnerActive` key on the `exit_reason` string, not `$?`; no `$?`-branching consumer of `pipeline-runner.js` exists in `extension/src`.
- **Heuristic over-suppression (R-CCR-13)** — a too-broad snippet-skip rule silently drops genuine `contract` findings. AC-CCR-13-2 is the guardrail.

## Assumptions

- A1: For R-CCR-1 the session-level working dir is the correct repo for a ticket's `completion_commit`; the fallback is gated to dir-unusable git failures only and logs when it fires.
- A2: `PipelineRunnerExitCode.Success` is an acceptable terminal status for a handoff stop; no `$?`-branching consumer of `pipeline-runner.js` exists.
- A3: R-CCR-6's non-repaired sentinel is `Defaults.WORKER_TIMEOUT_SECONDS`; `repaired` stays `false` and state is NOT mutated for NaN/negative inputs.
- A4: `git merge-base --is-ancestor` exit semantics (0 = ancestor, 1 = not, 128 = bad repo) are stable across operator git versions.

## Sequencing

- R-CCR-3 → R-CCR-4 → R-CCR-5 → R-CCR-10 (handoff semantics; R-CCR-4 and R-CCR-10 both edit `pipeline-runner-phase-no-progress.test.js` — serialize).
- R-CCR-1 before R-CCR-8 (R-CCR-8's deliberately-unreachable-SHA fixture must be a single-repo session or R-CCR-1's fallback defeats it).
- R-CCR-9-3, R-CCR-12, R-CCR-13 are serialized on `check-readiness.ts`.

## Tickets

### R-CCR-1 — `frontmatterCompletionCommitReachable` session-dir fallback *(medium; fix + regression test)*
*(refined: codebase analyst — the real fix is a 2-arg→3-arg signature change; the `||` chain in `correctPhantomDoneTickets:900` never falls through because a stale `ticket.working_dir` is still a truthy string)*

`frontmatterCompletionCommitReachable(ticketPath, workingDir)` (`mux-runner.ts:853`)
gains a 3rd parameter — the session fallback base (`CorrectPhantomDoneTicketsInput.workingDir`).
When the `git -C <ticketWorkingDir> merge-base --is-ancestor` probe fails because
the dir is missing / not a git repo, retry ONCE against the session dir.
`phantomDoneShouldKeepDone` (`:880`) threads `input.workingDir` through. Fold the
R-CCR-11 memo here: memoize the repo-root / reachability probe across the new
fallback call sites.

**Acceptance criteria**
- AC-CCR-1-1: When the per-ticket workingDir probe fails because git could not run (dir missing / not a repo), the function retries once against the session working dir. It MUST NOT retry when git ran cleanly and reported not-an-ancestor.
- AC-CCR-1-2: A regression test: a ticket whose `working_dir` is a non-existent path while the real single-repo (with the HEAD-reachable commit) is the session working dir — `correctPhantomDoneTickets` does NOT revert it.
- AC-CCR-1-3: When the fallback probe fires, `correctPhantomDoneTickets` emits an activity-log entry recording the failed per-ticket `working_dir` and the fallback dir used.
- AC-CCR-1-4: A test: dir unusable AND SHA not reachable in the fallback repo → the watcher still reverts (genuine phantom).

### R-CCR-2 — `resolveRepoRoot` stable-base resolution *(small; fix + regression test)*
`resolveRepoRoot` (`mux-runner.ts:608`) resolves relative dirs against `process.cwd()`
in both the `git -C` probe and the `path.resolve` fallback. Resolve against a
stable base (the session working dir) before BOTH.

**Acceptance criteria**
- AC-CCR-2-1: Relative `working_dir` values are resolved against a stable base, not raw `process.cwd()`, before the `git -C` probe AND the `path.resolve` fallback.
- AC-CCR-2-2: A test with two tickets whose relative `working_dir`s denote the same repo resolves them to one root (no false multi-repo).

### R-CCR-3 — handoff exit_reason honored only on a clean exit; close both leaks *(medium; fix + regression test)*
*(refined: codebase analyst — the root cause is `claimPipelineRunnerActive`'s clear-set, which only nulls `'failed'`/`'completed'`; handoff reasons survive phase boundaries. Two leak exits: cross-phase and same-phase twin read at `finalizePipeline:2242`)*

**Acceptance criteria**
- AC-CCR-3-1: The handoff break in `runPhaseIteration` only fires when the phase runner exited with code 0.
- AC-CCR-3-2: A test with a non-zero phase exit plus a stale handoff exit_reason in state does NOT take the clean-handoff break path.
- AC-CCR-3-3: `claimPipelineRunnerActive` (`pipeline-runner.ts:726`) clears `manager_handoff_pending` and `closer_handoff_terminal` from `state.exit_reason` at phase entry, in addition to `'failed'`/`'completed'`. A test asserts a phase entered with a stale handoff exit_reason starts with `exit_reason === null`.
- AC-CCR-3-4: When `runPhaseIteration` declines the handoff break because the phase exited non-zero, the stale handoff `exit_reason` is cleared before returning, so `finalizePipeline`'s `readHandoffExitReason` read at `pipeline-runner.ts:2242` does not preserve it. A test asserts a non-zero phase exit carrying a handoff exit_reason terminates with a failure marker (`exit_reason='failed'`, exit `Failure`), NOT `step:'completed'` + the handoff reason.

### R-CCR-4 — a clean handoff stop exits Success, status `'completed'` *(medium; fix + regression test)*

`finalizePipeline` computes `const handoffStop = !!readHandoffExitReason(runtime.statePath)`.
The exit code (`:2284`), `writePipelineStatus` value (`:2275`), and
`writeFinalPipelineActivity` failed flag (`:2263`) branch on `handoffStop`, NOT
`pipelineFailed`. `pipelineFailed` itself is left untouched.

**Acceptance criteria**
- AC-CCR-4-1: A pipeline that stops on a `manager_handoff_pending` or `closer_handoff_terminal` exit_reason exits with `PipelineRunnerExitCode.Success` (0). No new `PipelineRunnerExitCode` member is added.
- AC-CCR-4-2: `pipeline-runner-phase-no-progress.test.js`'s R-PRH test updates its `captureMainExit` expectation from `PipelineRunnerExitCode.Failure` to `PipelineRunnerExitCode.Success`. The existing assertions that `state.exit_reason` stays `manager_handoff_pending` and that the pipeline does not advance to citadel MUST remain unchanged and green.
- AC-CCR-4-3: `pipeline-status.json` for a handoff stop reports the `PipelineStatusKind` literal `'completed'` (not `'failed'`). No change to `PipelineStatusKind` or `monitor.ts`. A test asserts the written status.

### R-CCR-5 — closer-release skipped on a handoff stop *(small; fix + regression test)*

**Acceptance criteria**
- AC-CCR-5-1: `finalizePipeline` carries a comment containing the literal greppable phrase `handoff stops skip closer-release`.
- AC-CCR-5-2: The closer-release gate becomes `if (!pipelineFailed && !handoffStop)`. A test asserts the closer-release `install`/`tag` actions are NOT invoked for a pipeline stopping on `manager_handoff_pending` AND NOT invoked for `closer_handoff_terminal`.

### R-CCR-6 — `repairZeroWorkerTimeout` return-contract hygiene (Option A) *(small; fix + regression test)*

**Acceptance criteria**
- AC-CCR-6-1: For a non-repaired result, `value` is a finite positive integer (never NaN, never ≤ 0): return the original `worker_timeout_seconds` when finite-positive, else `Defaults.WORKER_TIMEOUT_SECONDS`. `repaired` stays `false` for NaN/negative/missing inputs and `state.worker_timeout_seconds` is NOT mutated — the existing fatal-corruption re-validation in `validateStartupState` and the `mux-runner.ts:4032` startup block is preserved.
- AC-CCR-6-2: A test asserts the non-repaired contract for `0`-absent, negative, and NaN inputs — `repaired===false`, `value` finite-positive.

### R-CCR-7 — R-CCGR re-read reachability spy test *(trivial; coverage backfill — no `src/` change)*
*(refined: all three analysts — AC-CCR-7-1 as originally written is already satisfied by `mux-runner.test.js:2089`; re-scoped to the one property the existing tests do not pin)*

**Acceptance criteria**
- AC-CCR-7-1: A test spies on `hasCompletionCommit` and asserts it is invoked exactly twice for a commitless ticket under the production guard path (`rereadBackoffMs: 0`), proving the backoff re-read is reached, not short-circuited.

### R-CCR-8 — R-PDWR phantom-Done watcher coverage backfill *(small; coverage backfill — no `src/` change)*

**Acceptance criteria**
- AC-CCR-8-1: A test covers a ticket whose only evidence is `completion_commit_inferred` resolving to a HEAD-reachable commit — not reverted.
- AC-CCR-8-2: A test covers a ticket whose `completion_commit` SHA exists as an object but is NOT reachable from HEAD — the watcher still reverts it.

### R-CCR-9 — small test-coverage gaps *(small; coverage backfill — no `src/` change)*

**Acceptance criteria**
- AC-CCR-9-1: `guardRereadBackoffMs` env handling is tested — `PICKLE_GUARD_REREAD_BACKOFF_MS` honored, the 5000ms ceiling clamped, NaN/negative rejected to the 500ms default.
- AC-CCR-9-2: `detectMultiRepo` has a test for the relative-`working_dir` fallback and a mixed git-repo + non-repo-dir session.
- AC-CCR-9-3: `check-readiness` `extractContractReferences` has a test pinning the intentional behavior for `@`-scoped package paths and `./`-prefixed paths.

### R-CCR-10 — handoff + incomplete-tickets interaction regression test *(trivial; coverage backfill — no `src/` change)*

**Acceptance criteria**
- AC-CCR-10-1: A test in `pipeline-runner-phase-no-progress.test.js` asserts a clean (exit 0) pickle exit carrying BOTH a `manager_handoff_pending` exit_reason AND unresolved tickets preserves `exit_reason === 'manager_handoff_pending'` (not `phase_incomplete_tickets`). A symmetric assertion covers `closer_handoff_terminal`.

### R-CCR-12 — document PATH_RE's intentional `@`-scoped-path exclusion *(trivial; doc — no behavior change)*

**Acceptance criteria**
- AC-CCR-12-1: `check-readiness.ts` near `PATH_RE` has a comment containing the literal text `@`-scoped stating those paths are deliberately excluded (not in-repo refs).

### R-CCR-13 — close R-RHFP inline code-snippet false positives *(medium; fix + regression test)*
*(refined: codebase analyst — the finding class is `contract`, not `performance`; `performance` is the once-per-ticket `cache.deadline` wall-budget guard and cannot be asserted per-token)*

Inline code-snippet tokens (`t.skip()`, `t.mock.timers.enable()`, `inputs.run_count`)
match the dotted-chain regex at `extractContractReferences` (`check-readiness.ts:318-323`),
fail `resolveSymbolRef`, and emit a `contract` finding. The discrimination point is
`check-readiness.ts:318-323`; the proven suppression mechanism is
`loadReadinessAllowlist` / `extension/.readiness-allowlist.json`.

**Acceptance criteria**
- AC-CCR-13-1: A ticket body quoting `t.skip()` / `t.mock.timers.enable()` / `inputs.run_count` as inline code produces zero `contract` findings for those tokens.
- AC-CCR-13-2: A ticket body citing a genuine in-repo backticked symbol still produces a `contract` finding when that symbol does not resolve (no over-suppression).
- AC-CCR-13-3: A fixture test in `extension/tests/` proves both AC-CCR-13-1 and -2.

## Finding traceability

| Review finding | Ticket(s) |
|---|---|
| #60 R-PDWR robustness | R-CCR-1, R-CCR-8 |
| #54 R-MRFP robustness | R-CCR-2, R-CCR-9 |
| #53 R-PRH correctness | R-CCR-3, R-CCR-4, R-CCR-5, R-CCR-10 |
| #58 R-WTZ contract | R-CCR-6 |
| #61 R-CCGR coverage | R-CCR-7 |
| #64 R-RHFP | R-CCR-12, R-CCR-13 |

## Non-goals

- No `state.json` `schema_version` bump; no new `PipelineRunnerExitCode` member; no new CLI flags.
- No real `install`/`tag` wiring into the no-op closures at `pipeline-runner.ts:2267-2268`.
- No `monitor.ts` change (decision: reuse `'completed'`).
- No hand-edit of `extension/bin/` compiled mirrors — regenerate via `npx tsc`.
- The R-SSDF staging runtime (R-SSDF-1/3/4/5/6) — separate finding #46 bundle.

## Implementation Task Breakdown

| Order | ID | Title | Priority | Entry | Exit | Files |
|---|---|---|---|---|---|---|
| 10 | 2d7ca1a5 | R-CCR-2 resolveRepoRoot stable base | Medium | HEAD ≥ 4ec358e3 | cwd-independent repo-root resolution | mux-runner.ts |
| 20 | d98057de | R-CCR-1 frontmatterCompletionCommitReachable session-dir fallback | Medium | R-CCR-2 done | no false phantom-Done revert on stale dir | mux-runner.ts |
| 30 | 2d2676af | R-CCR-6 repairZeroWorkerTimeout return contract | Medium | HEAD ≥ 4ec358e3 | non-repaired value always finite-positive | mux-runner.ts |
| 40 | 5e26fafb | R-CCR-3 handoff exit_reason exit-0 gate + both leaks | High | HEAD ≥ 4ec358e3 | stale handoff reason never masks a failure | pipeline-runner.ts |
| 50 | 36b4ee64 | R-CCR-4 handoff stop exits Success / status completed | High | R-CCR-3 done | handoff stop exits 0, status completed | pipeline-runner.ts |
| 60 | 2d6731f9 | R-CCR-5 skip closer-release on handoff | Medium | R-CCR-4 done | handoff never triggers closer-release | pipeline-runner.ts |
| 70 | 0c68cd3a | R-CCR-12 document PATH_RE @-scoped exclusion | Low | HEAD ≥ 4ec358e3 | exclusion documented inline | check-readiness.ts |
| 80 | 7dde42ba | R-CCR-13 suppress inline-snippet contract false positives | Medium | R-CCR-12 done | no contract findings for snippet tokens | check-readiness.ts |
| 90 | fd921637 | R-CCR-7 R-CCGR re-read spy test | Low | HEAD ≥ 4ec358e3 | re-read reachability pinned | mux-runner.test.js |
| 100 | cda063f9 | R-CCR-8 phantom-Done coverage backfill | Medium | R-CCR-1 done | inferred-field + non-reachable cases pinned | mux-runner.test.js |
| 110 | 47fcd4f8 | R-CCR-9 small coverage gaps | Low | R-CCR-2/12/13 done | env + multi-repo + path edges pinned | mux-runner.test.js, check-readiness-rhfp.test.js |
| 120 | 5b822122 | R-CCR-10 handoff + incomplete-tickets test | Low | R-CCR-4 done | precedence pinned for both handoff reasons | pipeline-runner-phase-no-progress.test.js |
| 130 | 5c0f8066 | Harden: code quality | High | all impl done | zero P0-P1 violations | all R-CCR files |
| 140 | 4aa8be51 | Audit: data flow integrity | High | code-quality done | zero CRITICAL/HIGH data-flow findings | extension/src/bin/ |
| 150 | 1de2219f | Harden: test quality | High | data-flow done | every AC mapped, zero P0-P1 assertion gaps | R-CCR test files |
| 160 | aa1684a7 | Audit: cross-reference consistency | High | test-quality done | zero CRITICAL/HIGH doc/code mismatches | subsystem CLAUDE.md + R-CCR files |
