`f(a: &T)` lowers to `T*` and takes the argument's address at the call
site. The old rule passed any pointer argument through unchanged, so
`bubble_sort(nums)` with `arr: &list[int]*` (T = list[int]*) sent
`list[int]*` where `list[int]**` was declared and failed with a pointer
level 1 -> 2 CastError.
- _apply_auto_addr_arg compares the argument's structural pointer depth
with the parameter type instead of "is a pointer". For a Name whose
own alloca already has the parameter depth, the alloca is passed
directly: the `&obj` fold on an object-pointer variable drops one
level, which is wrong for `&T` with a pointer T.
- translate_call_arg falls back to the definition-side vpi annotation
when the same-module table misses, so a cross-module callee that has
not been body-translated yet still gets its &T modes.
- _coerce_args_to_def_params uses the injected declare's parameter type
when the vpi text cannot resolve it (e.g. a generic class name), and
passes that type to the auto-address transform.
- a null literal passed to `&T` keeps passing through (no lvalue).
Probe: `bubble_sort(nums)` sorts through `&list[int]*`; `bump(x)` and
`bump(p)` with `p: int*` both increment x (value addressed, pointer
passed through). Self-host 110/110; GenericTest3, ListTest, PtrOpProbe
pass; EscapeTest still reports its expected LifetimeError.
TermiNexus
94d8c0d151