fix: close type-safety holes found by adversarial review; update docs

Review findings (all reproduced, then fixed and re-verified):
- '^x' leaked as a raw address into any builtin context (s <- ^x printed
  the variable's bytes as a C string; NOT ^x, '&', and ^x = ^x compiled).
  Address-of is now rejected everywhere except a pointer-typed target.
- A whole-array variable passed the nominal gate as a value of its
  ELEMENT type (s <- arrayOfSeason stored the raw data pointer; = on it
  emitted invalid IR). Whole arrays are now rejected as operands and as
  coercion sources; array parameters are unaffected.
- Enum values smuggled into INTEGER through array subscripts and DECLARE
  bounds (a[Autumn], ARRAY[Spring:Winter]); both now go through
  emitCoercedExpr like every other INTEGER context.
- An array DECLAREd inside an IF/WHILE/REPEAT/FOR body and used after the
  block was a wild-pointer write (constant bounds) or a verifier dump
  (runtime bounds). Arrays are now block-scoped: control-flow bodies
  snapshot and restore the ArrayTable, so escape is a clean compile error.
- Duplicate parameter names silently shadowed (BYREF write-back defeated);
  now a parse error. Trailing comma in parameter lists accepted; now a
  parse error consistent with every other list.
- A variable/array/parameter/function could reuse a TYPE name; reserved.
- RETURN with a value inside a PROCEDURE was silently discarded (control
  did not return); now an error, as is a bare RETURN in a FUNCTION.
- INPUT r.f mis-parsed into a three-error cascade; now one clear error.
- Assigning to an enum constant now says so instead of 'Unknown variable'.

Docs: ARCH/CONVENTIONS/EXTENDING/SUBSYSTEMS/PITFALLS rewritten for the
TYPE system (ABI additions, nominal-typing invariants, admission-gate
doors, array-parameter ABI, new recipes, new sharp edges); README
features/TODO updated — random files are unblocked.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

6 files changed, 100 insertions, 9 deletions

diff --git a/lib/CodeGen/ArrayHandler.cc b/lib/CodeGen/ArrayHandler.cc
index c647d58..8b37b8f 100644
--- a/lib/CodeGen/ArrayHandler.cc
+++ b/lib/CodeGen/ArrayHandler.cc
@@ -88,15 +88,17 @@ void ArrayHandler::emitArrayDeclare(ArrayDeclareStmtAST *Stmt, CodeGen &CG) {
         CG.reportError("'%s' is an enum value and cannot be declared as an array", Name.c_str());
         return;
     }
+    if (Types.resolve(Name)) {
+        CG.reportError("'%s' is a type name and cannot be declared as an array", Name.c_str());
+        return;
+    }
 
     std::vector<Value*> Lows;
     std::vector<Value*> Highs;
 
     for (const auto &Pair : Stmt->getBounds()) {
-        Value *L = CG.emitExpr(Pair.first.get());
-        Value *R = CG.emitExpr(Pair.second.get());
-        L = CG.coerceValueToType(L, CG.resolveType("INTEGER"));
-        R = CG.coerceValueToType(R, CG.resolveType("INTEGER"));
+        Value *L = CG.emitCoercedExpr(Pair.first.get(), CG.resolveType("INTEGER"));
+        Value *R = CG.emitCoercedExpr(Pair.second.get(), CG.resolveType("INTEGER"));
 
         if (!L || !R) return;
 
@@ -178,8 +180,7 @@ bool ArrayHandler::emitCheckedIndices(const std::string &Name,
     }
 
     for (size_t i = 0; i < IndexExprs.size(); ++i) {
-        Value *Idx = CG.emitExpr(IndexExprs[i].get());
-        Idx = CG.coerceValueToType(Idx, CG.resolveType("INTEGER"));
+        Value *Idx = CG.emitCoercedExpr(IndexExprs[i].get(), CG.resolveType("INTEGER"));
         if (!Idx) return false;
 
         Out.push_back(Idx);
diff --git a/lib/CodeGen/CodeGen.cc b/lib/CodeGen/CodeGen.cc
index 64e1b9f..0e372d0 100644
--- a/lib/CodeGen/CodeGen.cc
+++ b/lib/CodeGen/CodeGen.cc
@@ -402,6 +402,11 @@ void CodeGen::emitDeclareStmt(DeclareStmtAST *Stmt) {
                     Stmt->getName().c_str());
         return;
     }
+    if (Types->resolve(Stmt->getName())) {
+        reportError("'%s' is a type name and cannot be declared as a variable",
+                    Stmt->getName().c_str());
+        return;
+    }
 
     Function *TheFunction = Builder->GetInsertBlock()->getParent();
     AllocaInst *Alloca = CreateEntryBlockAlloca(TheFunction, Info->LLVMType, Stmt->getName());
@@ -603,6 +608,18 @@ Value *CodeGen::emitExpr(ExprAST *Expr) {
     }
 
     if (auto *Bin = dynamic_cast<BinaryExprAST*>(Expr)) {
+        // Whole arrays evaluate to raw data pointers and ^x to raw addresses;
+        // neither is a value any operator may consume.
+        if (isWholeArrayVar(Bin->getLHS()) || isWholeArrayVar(Bin->getRHS())) {
+            reportError("A whole array cannot be used as an operand; index it");
+            return nullptr;
+        }
+        if (dynamic_cast<AddrOfExprAST*>(Bin->getLHS()) ||
+            dynamic_cast<AddrOfExprAST*>(Bin->getRHS())) {
+            reportError("'^' (address-of) can only be used where a pointer type is expected");
+            return nullptr;
+        }
+
         // Enum/Record/Pointer operands never reach ArithmeticHandler or the
         // '&' path: their admissible operations are decided by name here.
         const TypeInfo *LT = getExprTypeInfo(Bin->getLHS());
@@ -825,13 +842,18 @@ void CodeGen::emitIfStmt(IfStmtAST *Stmt) {
 
     Builder->CreateCondBr(CondV, ThenBB, ElseBB);
 
+    // Arrays are block-scoped: metadata SSA values and the buffer setup live
+    // inside the branch, so a declaration must not survive it.
+    auto SavedArrays = Arrays->snapshotTable();
     Builder->SetInsertPoint(ThenBB);
     for (const auto &S : Stmt->getThenStmts()) emitStmt(S.get());
     if (!Builder->GetInsertBlock()->getTerminator()) Builder->CreateBr(MergeBB);
+    Arrays->exchangeTable(SavedArrays);
 
     Builder->SetInsertPoint(ElseBB);
     for (const auto &S : Stmt->getElseStmts()) emitStmt(S.get());
     if (!Builder->GetInsertBlock()->getTerminator()) Builder->CreateBr(MergeBB);
+    Arrays->exchangeTable(std::move(SavedArrays));
 
     Builder->SetInsertPoint(MergeBB);
 }
@@ -851,8 +873,11 @@ void CodeGen::emitWhileStmt(WhileStmtAST *Stmt) {
 
     Builder->CreateCondBr(CondV, LoopBB, AfterBB);
 
+    // Arrays declared in the body are block-scoped (see emitIfStmt).
+    auto SavedArrays = Arrays->snapshotTable();
     Builder->SetInsertPoint(LoopBB);
     for (const auto &S : Stmt->getBody()) emitStmt(S.get());
+    Arrays->exchangeTable(std::move(SavedArrays));
 
     if (!Builder->GetInsertBlock()->getTerminator())
         Builder->CreateBr(CondBB);
@@ -869,8 +894,11 @@ void CodeGen::emitRepeatStmt(RepeatStmtAST *Stmt) {
 
     Builder->CreateBr(LoopBB);
 
+    // Arrays declared in the body are block-scoped (see emitIfStmt).
+    auto SavedArrays = Arrays->snapshotTable();
     Builder->SetInsertPoint(LoopBB);
     for (const auto &S : Stmt->getBody()) emitStmt(S.get());
+    Arrays->exchangeTable(std::move(SavedArrays));
     if (!Builder->GetInsertBlock()->getTerminator())
         Builder->CreateBr(CondBB);
 
@@ -934,8 +962,11 @@ void CodeGen::emitForStmt(ForStmtAST *Stmt) {
 
     Builder->CreateCondBr(CondV, LoopBB, AfterBB);
 
+    // Arrays declared in the body are block-scoped (see emitIfStmt).
+    auto SavedArrays = Arrays->snapshotTable();
     Builder->SetInsertPoint(LoopBB);
     for (const auto &S : Stmt->getBody()) emitStmt(S.get());
+    Arrays->exchangeTable(std::move(SavedArrays));
     if (!Builder->GetInsertBlock()->getTerminator())
         Builder->CreateBr(IncBB);
 
@@ -984,10 +1015,19 @@ void CodeGen::emitStmt(StmtAST *Stmt) {
     }
 
     if (auto *Ret = dynamic_cast<ReturnStmtAST*>(Stmt)) {
+        Function *F = Builder->GetInsertBlock()->getParent();
+        const FuncSig *Sig = FuncGen->getSignature(F->getName().str());
+        if (Sig && Sig->ReturnTypeName == "VOID" && Ret->getRetVal()) {
+            reportError("RETURN with a value is only allowed in a FUNCTION");
+            return;
+        }
+        if (Sig && Sig->ReturnTypeName != "VOID" && !Ret->getRetVal()) {
+            reportError("RETURN in a FUNCTION requires a value");
+            return;
+        }
         Value *RetVal = nullptr;
         if (Ret->getRetVal()) {
-            Function *F = Builder->GetInsertBlock()->getParent();
-            if (const FuncSig *Sig = FuncGen->getSignature(F->getName().str())) {
+            if (Sig) {
                 RetVal = emitCoercedExpr(Ret->getRetVal(), resolveType(Sig->ReturnTypeName));
             } else {
                 RetVal = emitExpr(Ret->getRetVal());
@@ -1006,7 +1046,11 @@ void CodeGen::emitStmt(StmtAST *Stmt) {
     if (auto *Assign = dynamic_cast<AssignStmtAST*>(Stmt)) {
         const SymbolInfo *Info = getSymbolInfo(Assign->getName());
         if (!Info) {
-            reportError("Unknown variable name %s", Assign->getName().c_str());
+            if (Types->lookupEnumConstant(Assign->getName())) {
+                reportError("Enum value %s is not an assignable location", Assign->getName().c_str());
+            } else {
+                reportError("Unknown variable name %s", Assign->getName().c_str());
+            }
             return;
         }
         if (Info->IsArray) {
diff --git a/lib/CodeGen/Designator.cc b/lib/CodeGen/Designator.cc
index a0ffe28..ad0cc49 100644
--- a/lib/CodeGen/Designator.cc
+++ b/lib/CodeGen/Designator.cc
@@ -200,6 +200,15 @@ Value *CodeGen::loadFromLValue(const LValueInfo &LV) {
 Value *CodeGen::emitCoercedExpr(ExprAST *E, const TypeInfo *Target) {
     if (!E || !Target) return nullptr;
 
+    // A whole-array reference evaluates to its raw data pointer, and
+    // getExprTypeInfo reports the ELEMENT type for it — both would slip
+    // through the name check and smash the pointer into the target.
+    if (isWholeArrayVar(E)) {
+        reportError("A whole array cannot be used as a value of type %s; index it",
+                    Target->Name.c_str());
+        return nullptr;
+    }
+
     const TypeInfo *Src = getExprTypeInfo(E);
 
     if (Target->isUserKind()) {
@@ -239,6 +248,14 @@ Value *CodeGen::emitCoercedExpr(ExprAST *E, const TypeInfo *Target) {
         return emitExpr(E); // same nominal type: no conversion needed
     }
 
+    // ^x is a raw address: admissible ONLY where a pointer type is expected.
+    // Without this check the ptr would coerce into STRING/BOOLEAN silently.
+    if (dynamic_cast<AddrOfExprAST*>(E)) {
+        reportError("'^' (address-of) can only be used where a pointer type is expected (got %s)",
+                    Target->Name.c_str());
+        return nullptr;
+    }
+
     if (Src && Src->isUserKind()) {
         reportError("Cannot use a value of type %s where %s is expected",
                     Src->Name.c_str(), Target->Name.c_str());
diff --git a/lib/CodeGen/FunctionGen.cc b/lib/CodeGen/FunctionGen.cc
index 77a37ec..99c6a1e 100644
--- a/lib/CodeGen/FunctionGen.cc
+++ b/lib/CodeGen/FunctionGen.cc
@@ -38,6 +38,10 @@ void FunctionGen::createArgumentAllocas(Function *F, const std::vector<ParamDecl
             fprintf(stderr, "Error: parameter '%s' collides with an enum value\n", P.Name.c_str());
             HadError = true;
         }
+        if (Types.resolve(P.Name)) {
+            fprintf(stderr, "Error: parameter '%s' collides with a type name\n", P.Name.c_str());
+            HadError = true;
+        }
         Value *ArgVal = &(*AI);
         ++AI;
         ArgVal->setName(P.Name);
@@ -98,6 +102,12 @@ Function *FunctionGen::emitPrototype(PrototypeAST *Proto) {
         HadError = true;
         return nullptr;
     }
+    if (Types.resolve(Proto->getName())) {
+        fprintf(stderr, "Error: '%s' is a type name and cannot be a FUNCTION/PROCEDURE name\n",
+                Proto->getName().c_str());
+        HadError = true;
+        return nullptr;
+    }
 
     FuncSig Sig;
     Sig.ReturnTypeName = Proto->getReturnType();
diff --git a/lib/Parser/Parser.cc b/lib/Parser/Parser.cc
index 9563650..260472c 100644
--- a/lib/Parser/Parser.cc
+++ b/lib/Parser/Parser.cc
@@ -542,7 +542,15 @@ std::unique_ptr<StmtAST> Parser::ParseStatementImpl() {
             return nullptr;
         }
         std::string Name = Lex.IdentifierStr;
+        int Line = Lex.getLine();
         getNextToken();
+        if (CurTok == '[' || CurTok == '.' || CurTok == '^') {
+            // Consume the whole designator so it cannot replay as statements.
+            std::vector<DesignatorAccess> Dummy;
+            ParseDesignatorSuffix(Dummy);
+            fprintf(stderr, "Error: INPUT target must be a plain variable at line %d\n", Line);
+            return nullptr;
+        }
         return std::make_unique<InputStmtAST>(Name);
     }
     else if (CurTok == tok_output) {
diff --git a/lib/Parser/ParserFunction.cc b/lib/Parser/ParserFunction.cc
index 776a980..81db2c7 100644
--- a/lib/Parser/ParserFunction.cc
+++ b/lib/Parser/ParserFunction.cc
@@ -106,6 +106,13 @@ std::optional<std::vector<ParamDecl>> Parser::ParsePrototypeArgs(bool AllowByRef
             return std::nullopt;
         }
 
+        for (const ParamDecl &Prev : Params) {
+            if (Prev.Name == P.Name) {
+                fprintf(stderr, "Error: Duplicate parameter name '%s' at line %d\n",
+                        P.Name.c_str(), Lex.getLine());
+                return std::nullopt;
+            }
+        }
         Params.push_back(std::move(P));
 
         if (CurTok == ')') break;
@@ -114,6 +121,10 @@ std::optional<std::vector<ParamDecl>> Parser::ParsePrototypeArgs(bool AllowByRef
             return std::nullopt;
         }
         getNextToken();
+        if (CurTok == ')') {
+            fprintf(stderr, "Error: Expected another parameter after ',' at line %d\n", Lex.getLine());
+            return std::nullopt;
+        }
     }
     getNextToken();
     return Params;