Fix VM: string handler no longer hijacks length() on non-strings; ArrayBox.length returns correct values (fixes json_lint loop). Add string-literal reader init guard earlier

src/backend/mir_interpreter/handlers/boxes_string.rs

@@ -12,13 +12,21 @@ pub(super) fn try_handle_string_box(
             eprintln!("[vm-trace] try_handle_string_box(method={})", method);
         }
         let recv = this.reg_load(box_val)?;
-        // Normalize receiver to trait-level StringBox to bridge old/new StringBox implementations
-        let sb_norm: crate::box_trait::StringBox = match recv.clone() {
-            VMValue::String(s) => crate::box_trait::StringBox::new(s),
-            VMValue::BoxRef(b) => b.to_string_box(),
-            other => other.to_nyash_box().to_string_box(),
+        // Handle ONLY when the receiver is actually a string.
+        // Do NOT coerce arbitrary boxes to StringBox (e.g., ArrayBox.length()).
+        let sb_norm_opt: Option<crate::box_trait::StringBox> = match recv.clone() {
+            VMValue::String(s) => Some(crate::box_trait::StringBox::new(s)),
+            VMValue::BoxRef(b) => {
+                if b.as_any().downcast_ref::<crate::box_trait::StringBox>().is_some() {
+                    Some(b.to_string_box())
+                } else {
+                    None
+                }
+            }
+            _ => None,
         };
-        // Only handle known string methods here
+        let Some(sb_norm) = sb_norm_opt else { return Ok(false) };
+        // Only handle known string methods here (receiver is confirmed string)
         match method {
             "length" => {
                 let ret = sb_norm.length();