fix: close type-safety holes found by adversarial review; update docs

Review findings (all reproduced, then fixed and re-verified):
- '^x' leaked as a raw address into any builtin context (s <- ^x printed
  the variable's bytes as a C string; NOT ^x, '&', and ^x = ^x compiled).
  Address-of is now rejected everywhere except a pointer-typed target.
- A whole-array variable passed the nominal gate as a value of its
  ELEMENT type (s <- arrayOfSeason stored the raw data pointer; = on it
  emitted invalid IR). Whole arrays are now rejected as operands and as
  coercion sources; array parameters are unaffected.
- Enum values smuggled into INTEGER through array subscripts and DECLARE
  bounds (a[Autumn], ARRAY[Spring:Winter]); both now go through
  emitCoercedExpr like every other INTEGER context.
- An array DECLAREd inside an IF/WHILE/REPEAT/FOR body and used after the
  block was a wild-pointer write (constant bounds) or a verifier dump
  (runtime bounds). Arrays are now block-scoped: control-flow bodies
  snapshot and restore the ArrayTable, so escape is a clean compile error.
- Duplicate parameter names silently shadowed (BYREF write-back defeated);
  now a parse error. Trailing comma in parameter lists accepted; now a
  parse error consistent with every other list.
- A variable/array/parameter/function could reuse a TYPE name; reserved.
- RETURN with a value inside a PROCEDURE was silently discarded (control
  did not return); now an error, as is a bare RETURN in a FUNCTION.
- INPUT r.f mis-parsed into a three-error cascade; now one clear error.
- Assigning to an enum constant now says so instead of 'Unknown variable'.

Docs: ARCH/CONVENTIONS/EXTENDING/SUBSYSTEMS/PITFALLS rewritten for the
TYPE system (ABI additions, nominal-typing invariants, admission-gate
doors, array-parameter ABI, new recipes, new sharp edges); README
features/TODO updated — random files are unblocked.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

1 files changed, 7 insertions, 6 deletions

diff --git a/lib/CodeGen/ArrayHandler.cc b/lib/CodeGen/ArrayHandler.cc
index c647d58..8b37b8f 100644
--- a/lib/CodeGen/ArrayHandler.cc
+++ b/lib/CodeGen/ArrayHandler.cc
@@ -88,15 +88,17 @@ void ArrayHandler::emitArrayDeclare(ArrayDeclareStmtAST *Stmt, CodeGen &CG) {
         CG.reportError("'%s' is an enum value and cannot be declared as an array", Name.c_str());
         return;
     }
+    if (Types.resolve(Name)) {
+        CG.reportError("'%s' is a type name and cannot be declared as an array", Name.c_str());
+        return;
+    }
 
     std::vector<Value*> Lows;
     std::vector<Value*> Highs;
 
     for (const auto &Pair : Stmt->getBounds()) {
-        Value *L = CG.emitExpr(Pair.first.get());
-        Value *R = CG.emitExpr(Pair.second.get());
-        L = CG.coerceValueToType(L, CG.resolveType("INTEGER"));
-        R = CG.coerceValueToType(R, CG.resolveType("INTEGER"));
+        Value *L = CG.emitCoercedExpr(Pair.first.get(), CG.resolveType("INTEGER"));
+        Value *R = CG.emitCoercedExpr(Pair.second.get(), CG.resolveType("INTEGER"));
 
         if (!L || !R) return;
 
@@ -178,8 +180,7 @@ bool ArrayHandler::emitCheckedIndices(const std::string &Name,
     }
 
     for (size_t i = 0; i < IndexExprs.size(); ++i) {
-        Value *Idx = CG.emitExpr(IndexExprs[i].get());
-        Idx = CG.coerceValueToType(Idx, CG.resolveType("INTEGER"));
+        Value *Idx = CG.emitCoercedExpr(IndexExprs[i].get(), CG.resolveType("INTEGER"));
         if (!Idx) return false;
 
         Out.push_back(Idx);