Unblinded after review: A = Mercury 3, B = GPT-6 Luna, C = Claude Haiku 5.5. Written by a reviewing agent (Opus) and published unedited. # Review: c06-stderr-escape All three candidates escape at the single `EmojiFormatter` boundary, pass the full hidden suite (10/10), have clean fmt, clippy and dprint, and leave stdout and exit codes unchanged. I built a copy of each tree and probed stderr with `cat -A`. The probes covered `-vv init` on a name containing ESC, U+009B, DEL, CR, TAB and a literal backslash, a FIFO error, a symlink, a TOML type error, raw control bytes in `.treeward`, a failed `-C` chdir, and a pseudo-terminal run. No candidate let a raw control character through. What separates them is how they render escapes, how accurate their SPEC text is, and whether they reuse the existing helper. Observed rendering for the same hostile name: | Candidate | ESC / C1 / DEL | CR/TAB/LF | literal `\` | | --------- | ----------------------------- | ---------- | ---------------- | | A | `\\x1b`, `\\u{9b}`, `\\x7f` | `\r` `\t` | doubled | | B | `\x1b`, `\u{9b}`, `\x7f` | `\r` `\t` | not doubled | | C | `\u{1b}`, `\u{9b}`, `\u{7f}` | `\r` `\t` | doubled | | stdout | `\u{1b}`, `\u{9b}`, `\u{7f}` | `\r` `\t` | doubled | ## Candidate C: overall 9/10 C fixed the problem at its root. It replaced `ctx.format_fields` with a `tracing::field::Visit` impl that sends every value through the shared `escape_control`, which it moved to `src/util/escape.rs`. This also takes tracing-subscriber's own ANSI sanitizer off the path, so stderr output matches the stdout listing and stays unambiguous. | Requirement | Verdict | Evidence | | -------------------------------------------- | ------- | ---------------------------------------------------------- | | No raw CR/LF/TAB on stderr | met | All probes; hidden tests | | No raw ESC/C1/DEL | met | Does its own escaping after bypassing tracing's sanitizer | | Only raw newline ends each message | met | Values escaped, prefix and newline raw | | Every stderr diagnostic covered | met | Central visitor; chdir and TOML errors escaped | | Name recognisable | met | Same rendering as stdout | | Exit codes and stdout unchanged | met | Helper moved verbatim | | SPEC.md updated | met | Merged bullet, and its claims match the observed output | Bugs: none found. A cosmetic note: the visitor drops tracing's default layout, so non-message string fields would print unquoted and `log.*` fields would not be filtered. Neither case can happen today, because treeward logs only message fields. Scope: the helper move is justified. Tests: four end-to-end tests with strict UTF-8 decoding (LF forging a line, CR, a FIFO error with LF, a ward entry name with NUL and ESC), plus documented unit tests for the helper. The summary is accurate, including its explanation of tracing's sanitizer, which the probe output confirms. ## Candidate A: overall 8/10 A follows the reference design. It buffers the whole formatted line, runs it through `escape_control` (moved to `src/util/escape.rs`), and writes one newline. | Requirement | Verdict | Evidence | | -------------------------------------------- | ------- | ------------------------------------------------------------------------ | | No raw CR/LF/TAB on stderr | met | All probes; hidden tests | | No raw ESC/C1/DEL | met | Double-escaped (`\\x1b`) but nothing raw | | Only raw newline ends each message | met | Multi-line TOML errors collapse to one line | | Every stderr diagnostic covered | met | Central formatter; soft chdir test passes | | Name recognisable | met | `evil-a\nERROR: forged.txt` on one line | | Exit codes and stdout unchanged | met | Listing identical | | SPEC.md updated | partial | Claims stderr uses the stdout escapes and is unambiguous, which is false | Bugs: - minor (verified): the SPEC says stderr control characters render as `\u{1b}` etc., with doubled backslashes making the output unambiguous. In practice ESC prints as `\\x1b`, which is exactly what a name containing the literal text `\x1b` prints. A FIFO named `fifo-[31m-\x1b-` shows `fifo-\\x1b[31m-\\x1b-`. The summary also says U+009B renders as `\u{9b}`; it actually renders as `\\u{9b}`. Scope: the helper move is justified. The helper's tests stay in `diffing.rs` with a redundant import, which is harmless. Tests: three end-to-end tests (LF forging a log line, CR in a FIFO error, LF in a ward sha256 error), all failing on the parent, but they decode stderr lossily. ## Candidate B: overall 7/10 B adds an `EscapingWriter` that wraps the field output and escapes each control character with `escape_debug`. Nothing else in the code changes. | Requirement | Verdict | Evidence | | -------------------------------------------- | ------- | ------------------------------------------------- | | No raw CR/LF/TAB on stderr | met | All probes; hidden tests | | No raw ESC/C1/DEL | met | Relies on tracing for these, plus its own pass | | Only raw newline ends each message | met | `writeln` after the escaped fields | | Every stderr diagnostic covered | met | Central formatter | | Name recognisable | met | Single escapes | | Exit codes and stdout unchanged | met | stdout untouched | | SPEC.md updated | met | Accurate; notes the clap exclusion | Bugs: - minor (verified): backslashes are not doubled, so the output is ambiguous. In the FIFO example above, both the real ESC and the literal text print as `\x1b`. A name containing a literal `\nERROR` looks the same as one containing an escaped newline. Scope: the smallest diff (three files). It writes a second escaper that disagrees with the stdout one instead of reusing `escape_control`. Tests: two end-to-end tests with strict decoding (LF/CR/TAB/DEL/C1 in a name, LF in a ward entry name). There is no test for a FIFO error line. The summary gets one thing wrong: it says `escape_debug` renders DEL as `\x7f`. It renders it as `\u{7f}`; the `\x7f` comes from tracing's sanitizer. ## Ranking 1. C (9) 2. A (8) 3. B (7) All three are functionally correct for the requirement. C showed the most insight: it saw that tracing already pre-escapes some characters, made the shared helper the only escaper, and wrote a SPEC that matches what the tool does. A is a faithful copy of the reference design, but its SPEC overstates how faithful and unambiguous the stderr rendering is. B has the most accurate SPEC and the smallest diff, but it duplicates the escaping logic without backslash doubling, so stdout and stderr follow different rules and the stderr output is ambiguous.