The starter loads a[i] before it checks anything: repair at_or_default so the element is fetched only after i is proven to be an index of a, and fallback is returned in every other case.

• a points to n readable int values. i is the index the caller asks for, and fallback is the value to hand back when that index does not exist.
• Return a[i] when i is at least 0 and strictly below n. Return fallback otherwise. The examples print the returned value on its own line.
• The starter builds with no diagnostic at all. i only exists at run time, so there is no bounds warning to catch anything for you. The whole defect is the order of two statements: a[i] is copied into a local before the bounds test runs, which reads outside the array on every invalid index.
• Look at what that buys you on the first run. A whole run of tests comes back green, because the value read out of bounds is thrown away as soon as the test rejects the index. Then one test kills the process, and every test after it is skipped. A read past the end may hand back something plausible or it may end your program, and you do not get to pick.
• Nothing outside a[0] through a[n - 1] may be read, not even into a local you then throw away. Prove the index first, load second.
• i is a signed long, so settle the sign while it is still signed. Cast n down to long for the comparison and every negative i looks in range. Cast i up to size_t first and -1 becomes 18446744073709551615, no longer distinguishable from a real index. The same wrap waits on the other side: n - 1 where n is a size_t of 0 is not -1, it is that same enormous number.
• An n of 0 leaves no valid index whatsoever. a is never read in that case, and the caller may pass a null pointer along with it.
• n is the contract, not the size of the block behind a. A caller who owns five ints and passes an n of 3 gets fallback for index 3, even though that element sits right there in memory.
• One past the end and a million past the end get the same answer. No clamping, no wrapping: an out of range index yields fallback, never the value stored next to it.
• fallback comes back exactly as it was passed. A valid element is returned even when it looks like an error marker, so a stored -1 is a value like any other.

The starter loads a[i] before it checks anything: repair at_or_default so the element is fetched only after i is proven to be an index of a, and fallback is returned in every other case.

• a points to n readable int values. i is the index the caller asks for, and fallback is the value to hand back when that index does not exist.
• Return a[i] when i is at least 0 and strictly below n. Return fallback otherwise. The examples print the returned value on its own line.
• The starter builds with no diagnostic at all. i only exists at run time, so there is no bounds warning to catch anything for you. The whole defect is the order of two statements: a[i] is copied into a local before the bounds test runs, which reads outside the array on every invalid index.
• Look at what that buys you on the first run. A whole run of tests comes back green, because the value read out of bounds is thrown away as soon as the test rejects the index. Then one test kills the process, and every test after it is skipped. A read past the end may hand back something plausible or it may end your program, and you do not get to pick.
• Nothing outside a[0] through a[n - 1] may be read, not even into a local you then throw away. Prove the index first, load second.
• i is a signed long, so settle the sign while it is still signed. Cast n down to long for the comparison and every negative i looks in range. Cast i up to size_t first and -1 becomes 18446744073709551615, no longer distinguishable from a real index. The same wrap waits on the other side: n - 1 where n is a size_t of 0 is not -1, it is that same enormous number.
• An n of 0 leaves no valid index whatsoever. a is never read in that case, and the caller may pass a null pointer along with it.
• n is the contract, not the size of the block behind a. A caller who owns five ints and passes an n of 3 gets fallback for index 3, even though that element sits right there in memory.
• One past the end and a million past the end get the same answer. No clamping, no wrapping: an out of range index yields fallback, never the value stored next to it.
• fallback comes back exactly as it was passed. A valid element is returned even when it looks like an error marker, so a stored -1 is a value like any other.