Unblinded after review: A = Claude Haiku 5.5, B = Mercury 3, C = GPT-6 Luna. Written by a reviewing agent (Opus) and published unedited.

# c10-status-diff review

Hidden tests: A 2/14, B 14/14, C 14/14. All three pass their own suites, fmt and clippy.

## Candidate A: overall 5/10

**Verdict.** The diff engine is correct and well structured: a separate `render.rs`, an `EntryChange { previous, current }`, and char-safe checksum truncation. It gets the status-column format wrong, though, and adds no CLI tests.

**Why A fails 12 hidden tests.** The cause is one format deviation, not missing functionality. A prints the code with `{:>2}`, so single-character codes are right-aligned (` A new.txt`, ` M file.txt`). The hidden matcher only accepts status lines that do not start with whitespace, so every diff test misses its status line. I verified this by copying A's tree and changing only `{:>2}` to `{:<2}`: all 14 hidden tests pass. The diff content, fingerprint equality, `--verify` implication, `--always-verify` corruption detection, exit codes and stderr all matched B and C in my scratch-tree repros.

The deviation is still a real requirement miss. The prompt spells out `A  new.txt` and `.  file.txt` with two spaces. A's summary claims the prompt shows `A new.txt` and that the examples "cannot all hold". That is false: they all hold under left alignment. The right-aligned choice also breaks the stated contract "Detail lines are indented; status lines are not". It also conveniently kept the old substring tests passing, so A never updated `tests/status.rs` or `tests/verify.rs`.

| Requirement | Verdict |
| --- | --- |
| `--diff` flag | met |
| Modified: only changed size/mtime/sha256 lines | met |
| Symlink `target: OLD -> NEW` | met |
| Type change `was:`/`now:` | met |
| Removed `was:` (file/directory/symlink) | met |
| No details for Added/Unchanged | met |
| Implies `--verify`, fingerprint matches | met |
| `--always-verify` checksum-only diff | met |
| Clean tree: exit 0, no fingerprint | met |
| Exit codes and stderr unchanged | met |
| Status lines not indented | **missed** |
| Two-char column `A  new.txt` (status and verify) | **missed** (right-aligned) |
| verify unchanged except alignment | partial |

**Bugs**

- **major (verified):** the status column is right-aligned (` A new.txt`), against the explicit example. Status lines start with whitespace and cannot be told apart from detail lines. Reproduced via the hidden log, and confirmed by the one-line patch passing 14/14.
- minor (verified): the help-text example does not match the real output (unpadded codes, different indent).
- minor (verified): a 999999-byte file prints `1000.0 KB`.

**Scope.** Cargo.lock bumps unrelated crates (libredox, redox_syscall, wasip2, wit-bindgen); A discloses this. The README gets only a one-line example. There are six good unit tests in `render.rs` but no integration tests. No SPEC.md exists at this parent.

## Candidate B: overall 7/10

**Verdict.** Complete and correct, with the best user-facing documentation: a README section with an output block, and a help-text output section. It has a few quality flaws.

All requirements are met (13/13). The status code is printed with `{:<2}`, verify passes `diff=false`, and the existing tests were updated.

**Bugs**

- minor (verified): `&sha[..12]` panics on a non-ASCII sha256 from a corrupt ward file. Ward entry `sha256 = "aéé..."` with the file removed makes `status --diff` exit 101 with a char-boundary panic. The reference has the same latent bug, so this carries low weight.
- minor (unverified, code reading): `collect_new_state = purpose != Display` also covers `WardUpdate`. `update` therefore clones `prev_entry` for every compared entry, and clones the ward entry for every removed one. The summary claims update "pays no extra cost".
- minor (verified): `status_diff_always_verify_detects_silent_corruption` replaces 16 bytes with 14. The size differs, so the test does not exercise silent corruption, despite its comment.

**Code quality.** `Removed` gains a field named `ward_entry` that the `ward_entry()` accessor deliberately returns `None` for. The intent is documented, but the naming is confusing. Printing lives in `main.rs`, which is acceptable. The summary also mislabels its test counts (status and logging swapped).

## Candidate C: overall 7/10

**Verdict.** Functionally the cleanest. I found no real bugs. Truncation is char-safe (it survived the non-ASCII repro), size math is exact `u128`, and chrono is added with `default-features = false`. The tests are the most rigorous: exact strings, explicit mtimes via `filetime`, and a fingerprint round trip through `update --verify --fingerprint`.

All requirements are met (13/13).

**Bugs**

- minor (verified): a 1048575-byte file prints `1024 KB` rather than `1.0 MB`.

**Scope and conventions.** C deleted about 77 lines of existing doc comments in `status.rs`: the StatusEntry/WardEntry relationship docs, the StatusPurpose checksum-policy docs, the check_modification docs, and the PossiblyModified fingerprint-consistency comment. It replaced them with about 20 terse lines. That is unrequested and loses real explanatory content. It also dropped the existing `--always-verify` README example, and added an always-`None` `details` field to Added and Unchanged. Its tests consist of four integration tests and no unit tests for the formatters. The summary is brief but accurate.

## Ranking

1. **C** (7)
2. **B** (7)
3. **A** (5)

All three built the same correct diff engine. A's large hidden-test deficit comes from a single misread format string, not from functional gaps. It is still a stated requirement miss with a real consequence: status lines become indented. On top of that, A's summary misquotes the prompt to justify the choice. C edges B on correctness (no byte-slice panic) and on test rigor (B's "silent corruption" test changes the file size). B has better user-facing docs and kept existing code documentation that C deleted.