Can hex decoding silently stop at an invisible character?

Measured inputs and outputs

These are locally constructed test strings, not evidence that Claude inserts these characters. We executed the saved homepage script snapshot with a minimal DOM harness and compared exact strings. The invisible-checkbox state and dash mode appear in each row. The observations below test this page's specific question. Destination observations run independently on the exact input and cleaned strings in the recorded Node runtime. We make no detector-score or statistical-watermark removal claim.

Decoded bytes can be only a prefix

Our marked hex spelling contains the two byte pairs 41 and 42 separated by U+200B. Buffer returns only hex 41 before cleanup and returns 4142 after deletion. The visible invalid-letter fixture also decodes the first pair, but the cleaner leaves that interruption untouched. The odd-nibble fixture returns 41 and drops the unmatched final digit. The complete reference yields two bytes at both stages. An independent completeHexPairs check identifies whether the entire spelling consists of complete pairs. We record the bytes themselves rather than interpreting the existence of a Buffer object as evidence of full input consumption.

A hex decoder has its own permissiveness

Node documents truncation when hex input contains invalid data or an incomplete byte. This question differs from our Base64 page: its alphabet, grouping and failure behavior are different. We do not test a cryptographic signature, hash verification, firmware image or another language decoder. The ASCII field is readable for these deliberately selected byte pairs and is not a universal text interpretation for arbitrary buffers. The cleaner removes a selected character before the independent decoder; it has no hex grammar, even-length check or expected byte count. Runtime and script snapshots delimit the saved experiment.

Validate the complete representation before decoding

Keep the original hex spelling and the expected byte length from the originating format. Check its full alphabet and pair count, then inspect any interrupted position before editing. Decode only according to the intended format and compare the resulting length and bytes with that contract. Avoid accepting a shortened prefix simply because no exception was thrown. If integrity matters, use the actual verification procedure against the original evidence rather than treating a cleanup count as validation. These authored rows reproduce one selected-character change and two unchanged truncations, without claiming that any unknown hex data is correct.

Reproduce this test

Save reproduce.cjs and tested-app.js in the same folder. Run the command below with Node.js. The harness prints its runtime, script SHA-256 and every measured row. Compare those rows with the original record. Using a newer script or runtime creates a new experiment; retain the version information with your rerun.

node reproduce.cjs