Smart Contract Diff Audit L-14: Fixed Script Module Paths Can Misattribute Execution Errors in a Shared `SourceManager`

Scripts compiled from string sources are registered in the source manager under constant module paths. [`compile_tx_script`](https://github.com/0xMiden/protocol/blob/8411bf093bde25285708faac152b6d7269009617/crates/miden-standards/src/code_builder/mod.rs#L527-L563) and [`compile_note_script`](https://github.com/0xMiden/protocol/blob/8411bf093bde25285708faac152b6d7269009617/crates/miden-standards/src/code_builder/mod.rs#L576-L612) always pass the [`TX_SCRIPT_MODULE_PATH` and `NOTE_SCRIPT_MODULE_PATH`](https://github.com/0xMiden/protocol/blob/8411bf093bde25285708faac152b6d7269009617/crates/miden-standards/src/code_builder/mod.rs#L30-L31) constants as the default path, and [`parse_script_str`](https://github.com/0xMiden/protocol/blob/8411bf093bde25285708faac152b6d7269009617/crates/miden-standards/src/code_builder/mod.rs#L77-L86) turns that path into the URI under which the source text is stored. The default source manager keeps an existing entry only when both the URI and the content match, so compiling a second script of the same kind against the same manager repoints `::tx_script` or `::note_script` at the newer source file.

Two compilations can end up sharing a source manager without any explicit setup. [`CodeBuilder`](https://github.com/0xMiden/protocol/blob/8411bf093bde25285708faac152b6d7269009617/crates/miden-standards/src/code_builder/mod.rs#L248-L253) derives `Clone` over an `Arc`, and the documented workflow for building several scripts is to clone the builder, while a single transaction that consumes two input notes whose scripts were both compiled from strings registers both under `::note_script`. Because the executor resolves the source of a runtime error purely by URI in [`get_label_and_source_file`](https://github.com/0xMiden/protocol/blob/8411bf093bde25285708faac152b6d7269009617/crates/miden-tx/src/executor/exec_host.rs#L431-L439), a failure raised in one script can be rendered against the text of another, yielding a source snippet that points at unrelated code. The consequence is confined to diagnostics: MAST roots, note commitments, and account state are unaffected, lookups by source identifier remain correct so assembly-time diagnostics still resolve properly, and [`write_into`](https://github.com/0xMiden/protocol/blob/8411bf093bde25285708faac152b6d7269009617/crates/miden-protocol/src/note/script.rs#L387-L391) omits debug information from serialized note scripts, which keeps the mis-rendering inside a single process. Sources supplied as an already loaded source file, a parsed module, or a filesystem path do not register under the constants and are therefore unaffected.

Consider deriving a unique default module path for every compilation, for example from a per-builder counter or a hash of the source text, rather than the fixed `::tx_script` and `::note_script` values. The in-repository note builder already follows this pattern in [`testing/note.rs`](https://github.com/0xMiden/protocol/blob/8411bf093bde25285708faac152b6d7269009617/crates/miden-standards/src/testing/note.rs#L190-L198), where the URI is derived from the note serial number. Alternatively, consider instantiating a separate source manager per compilation wherever source text may be rendered back to a caller. The same consideration applies to the fixed `_tx_context_code` URI in [`context.rs`](https://github.com/0xMiden/protocol/blob/8411bf093bde25285708faac152b6d7269009617/crates/miden-testing/src/tx_context/context.rs#L109-L114), which avoids the collision today only because registration immediately precedes execution.

---

_Copied verbatim from finding [L-14](https://audits.openzeppelin.com/miden/miden-01-07-smart-contract-diff-audit-nfts/issues/fixed-script-module-paths-can-misattribute-execution-errors-in-a-shared-sourcemanager-15125721) (low severity) of the OpenZeppelin [smart contract diff audit (NFTs)](https://audits.openzeppelin.com/miden/miden-01-07-smart-contract-diff-audit-nfts). The audit was performed against commit `8411bf093bde25285708faac152b6d7269009617`._