Text-Value Ownership in Pcee's Memory Model: An Empirical Investigation and Design Note for Phase 9

This deposit documents an empirical investigation into whether "free everything at scope exit" — the approach proposed for Pcee v0.8.0's Phase 9 memory model — is actually safe. It is not: three distinct failure modes (heap-use-after-free on returned strings, double-free on aliasing, and a free-of-non-heap-memory bug caused by Pcee's lack of a literal-vs-heap-pointer distinction) were reproduced against the compiler's generated C and confirmed with AddressSanitizer. A block-local text-provenance pass was implemented as a proof of concept and verified: all three failure modes fixed and ASan-clean, all 17 existing regression tests unchanged byte-for-byte, no new crashes. A known, deliberate limitation (cross-block escape) is left unresolved and documented. The design note grounds these findings in prior art — principally CERT/CMU's Pointer Ownership Model (POM), plus CCured, Cyclone, and recent Rust-inspired borrow-checking work for C — and gives concrete recommendations for Pcee's actual Phase 9 design. IMPORTANT: the accompanying code (pcee_compile_patched.c) is validation evidence for this design investigation only. It is not the Phase 9 implementation and should not be cited or reused as one. Contents: design note (markdown), patched compiler source, 5 test cases (.pcy) reproducing the failure modes, and a README.