# DEFECT — string literals containing control bytes compile to a heap address

Not a cycle claim. This is a **live miscompilation in the current compiler**, found
incidentally during the cycle 01–10 evidence re-run and confirmed at branch HEAD.

It is filed with the evidence because it invalidates a *method* that cycles 01–04 rely
on: "the emitted C is byte-identical" is only meaningful if the emitter is
deterministic, and for affected inputs it is not.

## Provenance

Captured from a clean detached worktree at `9540f2399` (`iteration-2` HEAD), compiler
built at that commit. All artifacts `tree=clean`.

Found by the cycle 04 agent while checking prediction 5 ("existing `@manager` output
byte-identical") across the whole tree: of 378 `.el` files, 368 emitted identically
under the parent and the commit compiler, 9 failed under both, and **1 differed — and
differed from itself between two runs of the same compiler.** I reproduced it
independently at HEAD before accepting it.

## The defect

A string literal containing a raw control byte with no escape mapping is emitted as a
**decimal heap address** instead of the string.

`0002-control-char-vs-empty-and-printable.out` isolates it exactly:

```
 8:  el_val_t a = EL_STR("");
 9:  el_val_t b = EL_STR("ok");
10:  el_val_t c = EL_STR("4324455808");     <-- source literal is a raw 0x1F
11:  el_val_t d = EL_STR("\t");
```

- empty literal `""` — correct
- printable literal `"ok"` — correct
- **raw `0x1F` (unit separator) — emitted as `4324455808`**
- raw `0x09` (tab) — correct, `"\t"`

Tab has an escape mapping and survives. `0x1F` has none, and instead of being escaped
it falls through to a path that stringifies a pointer.

## It is nondeterministic

`0001-minimal-reproducer-control-char-literal.out`, three consecutive runs of the
**same** compiler on the **same** source:

```
--- emitted run 1 ---   el_val_t sep = EL_STR("4344967392");
--- emitted run 2 ---   el_val_t sep = EL_STR("4347851136");
--- emitted run 3 ---   el_val_t sep = EL_STR("4384031472");
```

The value tracks the process heap base, which moves under ASLR.

## It occurs in real code in this repository

`0003-real-file-nondeterminism-arbor-parse.out`. `arbor/vessels/arbor-parse/src/main.el`
uses `0x1F` as a field separator — El source line 259, shown through `cat -v`:

```
if i > 0 { let out = out + "^_" }
```

Two runs of the same compiler over that file produce different sha256, differing in
three places, each a separator literal rendered as a different address. Within a single
run the corrupted values differ by fixed offsets (`+2240`, `+32208`), consistent with
distinct literals in one heap arena; across runs the whole block shifts.

The file applies **no decorators at all**, so this is unrelated to the construct work
in cycles 01–10, and it reproduces at cycle 04's parent `4f7568b` as well as at HEAD.
It predates the cycle series.

## Why it matters

1. **Silent miscompilation.** `arbor-parse` builds and links. At runtime it joins and
   splits records on a separator that is a decimal rendering of an address rather than
   `0x1F` — and the encode and decode sides get *different* values whenever they are
   compiled separately. No diagnostic is produced at any stage.
2. **Reproducible builds are broken** for any source containing such a literal.
3. **It weakens byte-identity as a control.** Cycles 01, 02, 03 and 04 all assert
   "emitted C is byte-identical". Those assertions were checked on decorator-bearing
   sources, which are unaffected — the cycle 04 agent verified all 3 `@manager`/
   `@accessor` files emit identically — so no cycle verdict changes. But the control
   itself is only sound on inputs that avoid this defect, and nothing in the record
   says so.

## Verdicts

| Claim | Artifact | Verdict |
|---|---|---|
| Control-byte literals emit as an address, not the string | `0002` | **CONFIRMED** |
| The emitter is nondeterministic for such inputs | `0001` (3 runs) | **CONFIRMED** |
| A real file in this repo is affected | `0003` | **CONFIRMED** |
| The defect predates cycles 01–10 | cycle 04's `0049`-series (parent `4f7568b` shows it too) | **CONFIRMED** |

## Not fixed here

This evidence pass does not change code. The defect is recorded, reproduced, and
minimally isolated so it can be fixed and regression-tested separately. A fix should
escape all non-printable bytes in the literal emitter and add a test asserting that
compiling the same source twice yields byte-identical output.