el-retired/docs/v1/experiments/evidence/cycles/00-cross-cycle-emitter-nondeterminism-DEFECT/CLAIMS.md

DEFECT — string literals containing control bytes compile to a heap address

Not a cycle claim. This is a live miscompilation in the current compiler, found incidentally during the cycle 01–10 evidence re-run and confirmed at branch HEAD.

It is filed with the evidence because it invalidates a method that cycles 01–04 rely on: "the emitted C is byte-identical" is only meaningful if the emitter is deterministic, and for affected inputs it is not.

Provenance

Captured from a clean detached worktree at 9540f2399 (iteration-2 HEAD), compiler built at that commit. All artifacts tree=clean.

Found by the cycle 04 agent while checking prediction 5 ("existing @manager output byte-identical") across the whole tree: of 378 .el files, 368 emitted identically under the parent and the commit compiler, 9 failed under both, and 1 differed — and differed from itself between two runs of the same compiler. I reproduced it independently at HEAD before accepting it.

The defect

A string literal containing a raw control byte with no escape mapping is emitted as a decimal heap address instead of the string.

0002-control-char-vs-empty-and-printable.out isolates it exactly:

 8:  el_val_t a = EL_STR("");
 9:  el_val_t b = EL_STR("ok");
10:  el_val_t c = EL_STR("4324455808");     <-- source literal is a raw 0x1F
11:  el_val_t d = EL_STR("\t");

• empty literal "" — correct
• printable literal "ok" — correct
• raw 0x1F (unit separator) — emitted as 4324455808
• raw 0x09 (tab) — correct, "\t"

Tab has an escape mapping and survives. 0x1F has none, and instead of being escaped it falls through to a path that stringifies a pointer.

It is nondeterministic

0001-minimal-reproducer-control-char-literal.out, three consecutive runs of the same compiler on the same source:

--- emitted run 1 ---   el_val_t sep = EL_STR("4344967392");
--- emitted run 2 ---   el_val_t sep = EL_STR("4347851136");
--- emitted run 3 ---   el_val_t sep = EL_STR("4384031472");

The value tracks the process heap base, which moves under ASLR.

It occurs in real code in this repository

0003-real-file-nondeterminism-arbor-parse.out. arbor/vessels/arbor-parse/src/main.el uses 0x1F as a field separator — El source line 259, shown through cat -v:

if i > 0 { let out = out + "^_" }

Two runs of the same compiler over that file produce different sha256, differing in three places, each a separator literal rendered as a different address. Within a single run the corrupted values differ by fixed offsets (+2240, +32208), consistent with distinct literals in one heap arena; across runs the whole block shifts.

The file applies no decorators at all, so this is unrelated to the construct work in cycles 01–10, and it reproduces at cycle 04's parent 4f7568b as well as at HEAD. It predates the cycle series.

Why it matters

1. Silent miscompilation. arbor-parse builds and links. At runtime it joins and splits records on a separator that is a decimal rendering of an address rather than 0x1F — and the encode and decode sides get different values whenever they are compiled separately. No diagnostic is produced at any stage.
2. Reproducible builds are broken for any source containing such a literal.
3. It weakens byte-identity as a control. Cycles 01, 02, 03 and 04 all assert "emitted C is byte-identical". Those assertions were checked on decorator-bearing sources, which are unaffected — the cycle 04 agent verified all 3 @manager/ @accessor files emit identically — so no cycle verdict changes. But the control itself is only sound on inputs that avoid this defect, and nothing in the record says so.

Verdicts

Claim	Artifact	Verdict
Control-byte literals emit as an address, not the string	0002	CONFIRMED
The emitter is nondeterministic for such inputs	0001 (3 runs)	CONFIRMED
A real file in this repo is affected	0003	CONFIRMED
The defect predates cycles 01–10	cycle 04's 0049-series (parent 4f7568b shows it too)	CONFIRMED

Not fixed here

This evidence pass does not change code. The defect is recorded, reproduced, and minimally isolated so it can be fixed and regression-tested separately. A fix should escape all non-printable bytes in the literal emitter and add a test asserting that compiling the same source twice yields byte-identical output.