Unblinded after review: A = Mercury 3, B = GPT-6 Luna, C = Claude Haiku 5.5. Written by a reviewing agent (Opus) and published unedited. # c08-root-ward-type review All three candidates pass their own suites and all 5 hidden tests, with fmt, clippy (0 diagnostics) and dprint clean. I built copies of each tree and probed edge cases beyond the hidden tests: a FIFO at `.treeward`, `--dry-run` with a dangling link, the normal init/update/status cycle, and a dangling `.treeward` in a subdirectory, which no candidate touched and which matches the parent's behavior. All three behaved correctly and identically. The only difference was the error text. ## Candidate A: overall 8/10 Correct. The `symlink_metadata` gate sits in `ward_directory` before both guards. The test matrix is the broadest of the three: 4 shapes x 3 modes at unit level, the same again at CLI level, and the symlink case points at a real ward file. | Requirement | Verdict | Evidence | | ----------------------------------------------- | ------- | ----------------------------------------------------------- | | Looping symlink refused (all 3 commands) | met | lstat before guards; hidden test passes | | Dangling symlink refused, not replaced | met | hidden test; probe shows link intact, including dry-run | | Symlink to valid ward refused, not read through | met | hidden test; target bytes unchanged | | Directory refused | met | hidden test | | Exit 255, names path, "not a regular file" | met | `ERROR: /.treeward is not a regular file` | | No "Not/Already initialized" claim | met | returns before the guards | | Entry untouched | met | unit and CLI tests check entry type | | Normal absent/regular cases unchanged | met | hidden regression test passes | Bugs: - minor (not verified): the unit test compares the reported path to a non-canonical `root.join(".treeward")`, so it would fail on macOS (`/var` -> `/private/var`). Scope and conventions: SPEC.md updated. `tests/common/mod.rs` gains helpers, which is justified. Weaknesses: the three integration tests declare an outer `temp`/`root` that is shadowed and never used, the new tests use `//` comments where the rest of the file uses `///`, and the guards still call the now-redundant `ward_path.exists()`. The summary is honest. It notes that plain `update` on a dangling link did not reproduce the silent replacement, and that only `--allow-init` did. ## Candidate B: overall 8/10 Correct and compact. It classifies the entry once with `symlink_metadata` and reuses that boolean in both guards. It is the only candidate that corrected help text which claimed `--allow-init` "always succeeds". | Requirement | Verdict | Evidence | | ----------------------------------------------- | ------- | ------------------------------------------------- | | Looping symlink refused (all 3 commands) | met | hidden test passes | | Dangling symlink refused, not replaced | met | own test checks `read_link` target unchanged | | Symlink to valid ward refused, not read through | met | own test checks target bytes unchanged | | Directory refused | met | own test checks the sentinel inside survives | | Exit 255, names path, "not a regular file" | met | `Root .treeward path is not a regular file` | | No "Not/Already initialized" claim | met | early return | | Entry untouched | met | tests cover link target and directory contents | | Normal absent/regular cases unchanged | met | hidden regression test passes | Bugs: - minor (not verified): the CLI test expects the non-canonical root path in stderr, so it would fail on macOS. Scope and conventions: SPEC.md updated. The `src/cli/help_text.rs` edit is justified. There is no unit test, the variant docstring is a single thin line, and the SPEC bullet lacks the blank-line separator its neighbors use. The summary is accurate. ## Candidate C: overall 9/10 Correct, and the cleanest code. A `root_ward_present` helper mirrors the reference design. Its docstring explains why `exists()` and `load_if_exists` were wrong, and the helper maps `PermissionDenied` to the existing typed error. C also adds a regression test confirming that a regular file still counts as initialized. | Requirement | Verdict | Evidence | | ----------------------------------------------- | ------- | ------------------------------------------------------ | | Looping symlink refused (all 3 commands) | met | hidden test and own unit/CLI tests | | Dangling symlink refused, not replaced | met | unit test checks `read_link` target unchanged | | Symlink to valid ward refused, not read through | met | hidden test passes | | Directory refused | met | hidden test and own CLI test | | Exit 255, names path, "not a regular file" | met | `Root ward file is not a regular file; refusing ...` | | No "Not/Already initialized" claim | met | helper errors before the guards | | Entry untouched | met | type and target are compared before and after | | Normal absent/regular cases unchanged | met | own regular-file test; hidden regression passes | Bugs: - minor (verified by reading): the "valid-target" unit fixture links to an empty file, not a parseable ward, and the CLI test omits the symlink-to-valid-ward case. C's own tests would therefore miss a regression that followed a link to a good ward. The hidden test catches it. Scope and conventions: the change touches only `update.rs`, SPEC.md and `tests/init.rs`. The test path assertions canonicalize the root, so they are portable to macOS. The summary is thorough and accurate, and it names the TOCTOU window and the `status`/`verify` gaps as follow-ups. ## Ranking 1. C (9) 2. A (8) 3. B (8) All three are functionally equivalent and correct. None has a critical or major bug. C wins on design and documentation. A has the most thorough tests but sloppy test code and leftover `exists()` calls. B is the tightest diff and the only one that kept the help text consistent, but it has no unit test and thinner docs.