@@ -1058,6 +1058,8 @@ describe('code placeholder compiler', () => {
     "echo $(( $(cat <<-'EOF'\n\t{{KEY}}\n\tEOF\n) + 1 ))",
     '[[ {{KEY}} -eq 0 ]] && echo zero',
     '[[ "{{KEY}}" -eq 0 ]] && echo zero',
+    'declare -i n; declare -a n; n={{KEY}}',
+    'declare -i n; unset -f n; n={{KEY}}',
     'if [[ 0 -lt {{KEY}} ]]; then echo positive; fi',
     '[[ -n x && ( "{{KEY}}" -ge 1 ) ]]',
     '[[ $(printf "%s" "{{KEY}}") -ne 0 ]]',
@@ -1136,7 +1138,7 @@ describe('code placeholder compiler', () => {
   })
 
   it('preserves shell literal arithmetic text and leaves completed arithmetic frames', async () => {
-    const value = 'values[$(printf injected >&2)]'
+    const value = 'values[1]'
     const compiled = await compileCodePlaceholders({
       code: [
         'printf "%s\\n" "{{KEY}}"',
@@ -1180,6 +1182,7 @@ describe('code placeholder compiler', () => {
     '$(let x=1 <<EOF\n{{KEY}}\nEOF\n)',
     // biome-ignore lint/suspicious/noTemplateCurlyInString: shell parameter expansion, not a JS template
     'declare -A m; m[{{KEY}}]=x; printf "%s\\n" "${m[{{KEY}}]}"',
+    // biome-ignore lint/suspicious/noTemplateCurlyInString: shell parameter expansion, not a JS template
     'declare -A m; printf "%s\\n" "${m[{{KEY}}]}"',
     'declare -iA m; m[{{KEY}}]=1',
     'read -p "items[{{KEY}}]" name',
@@ -1198,7 +1201,7 @@ describe('code placeholder compiler', () => {
       compileCodePlaceholders({
         code,
         language: CodeLanguage.Shell,
-        environmentVariables: { KEY: 'values[$(printf injected >&2)]' },
+        environmentVariables: { KEY: 'values[1]' },
       })
     ).resolves.toBeDefined()
   })
@@ -1214,7 +1217,7 @@ describe('code placeholder compiler', () => {
   })
 
   it('compiles shell placeholders beside arithmetic that never evaluates them', async () => {
-    const value = 'values[$(printf injected >&2)]'
+    const value = 'values[1]'
     const compiled = await compileCodePlaceholders({
       code: [
         '[ "{{KEY}}" -eq 0 ] 2>/dev/null || printf "%s\\n" not-zero',
@@ -1249,6 +1252,62 @@ describe('code placeholder compiler', () => {
     )
   })
 
+  it.each([
+    ['an expansion in a subscript', 'a[$(cmd)]', 'an array subscript with an expansion'],
+    [
+      'a quoted bracket ending the walk early',
+      'a["]$(cmd)"]',
+      'an array subscript with an expansion',
+    ],
+    ['a backtick in a subscript', 'a[`cmd`]', 'an array subscript with an expansion'],
+    ['a process substitution in a subscript', 'a[<(cmd)]', 'an array subscript with an expansion'],
+    ['an escaped expansion in a subscript', 'a[\\$x]', 'an array subscript with an expansion'],
+    ['an unclosed subscript', 'a[', 'an unbalanced array subscript'],
+    ['a stray closing bracket', '$(cmd)]', 'an unbalanced array subscript'],
+    ['an open quote in a subscript', 'a["]', 'an unbalanced array subscript'],
+  ])('refuses a shell value with %s wherever it lands', async (_case, value, reason) => {
+    for (const code of ['printf "%s\\n" "{{KEY}}"', "cat <<'EOF'\n{{KEY}}\nEOF"]) {
+      await expect(
+        compileCodePlaceholders({
+          code,
+          language: CodeLanguage.Shell,
+          environmentVariables: { KEY: value },
+        })
+      ).rejects.toThrow(reason)
+    }
+  })
+
+  it.each(['values[1]', '["a", "b"]', '{"items": [1, 2]}', '$HOME and $(date)', "it's [done]"])(
+    'compiles a shell value whose subscripts hold no expansion: %s',
+    async (value) => {
+      const compiled = await compileCodePlaceholders({
+        code: 'printf "%s\\n" "{{KEY}}"',
+        language: CodeLanguage.Shell,
+        environmentVariables: { KEY: value },
+      })
+      expect(executeShell(compiled.code, compiled.bindings)).toBe(`${value}\n`)
+    }
+  )
+
+  it('refuses arithmetic positions whose values are safe alone', async () => {
+    // Code can supply the brackets, or split a subscript across adjacent placeholders, so the value
+    // guard cannot judge these alone; the position scan refuses them.
+    await expect(
+      compileCodePlaceholders({
+        code: 'total=$(( a[{{KEY}}] ))',
+        language: CodeLanguage.Shell,
+        environmentVariables: { KEY: '$(cmd)' },
+      })
+    ).rejects.toThrow('is not supported in shell arithmetic')
+    await expect(
+      compileCodePlaceholders({
+        code: 'total=$(( {{LEFT}}{{RIGHT}} ))',
+        language: CodeLanguage.Shell,
+        environmentVariables: { LEFT: 'a', RIGHT: '1' },
+      })
+    ).rejects.toThrow('is not supported in shell arithmetic')
+  })
+
   it('discovers shell arithmetic placeholders without compiling missing values', async () => {
     const code = 'total=$(( {{MISSING}} + {{KEY}} ))'
     await expect(analyzeCodePlaceholders(code, CodeLanguage.Shell)).resolves.toEqual([
 
@@ -92,6 +92,8 @@ interface ShellCommandScan {
   indexedOption?: boolean
   /** The command is a builtin (`unset`/`read`/…) whose name arguments carry arithmetic subscripts. */
   nameArgumentBuiltin?: boolean
+  /** An `unset -f` was read, so its arguments name functions and leave variable attributes alone. */
+  unsetsFunctions?: boolean
   /** True once the command word (past any `name=value` assignment prefix) has been read. */
   sawCommandWord: boolean
   /** A non-arithmetic assignment prefix is being read, so a later keyword must not mark its value. */
@@ -545,6 +547,45 @@ function shellExpansion(name: string, quote: ShellQuote): string {
   return expansion
 }
 
+/** Whether an expansion (`$…`, a backtick, `<(`/`>(`) starts at `index`. */
+function expansionStarts(value: string, index: number): boolean {
+  const character = value[index]
+  if (character === '$' || character === '`') return true
+  return (character === '<' || character === '>') && value[index + 1] === '('
+}
+
+/**
+ * The reason a value could run a command if it reached arithmetic evaluation, or undefined if it
+ * cannot. Arithmetic expands an array subscript again, so a subscript holding an expansion runs it.
+ * This backs up the position scan: any `[ … ]` holding an expansion is refused, as is an
+ * unbalanced bracket or an open quote inside one, since bash would then find the subscript's end in
+ * surrounding code. Quotes and escapes count inside a subscript, so a quoted `]` does not end it.
+ */
+function unsafeArithmeticSubscript(value: string): string | undefined {
+  let depth = 0
+  let quote: '"' | "'" | undefined
+  for (let index = 0; index < value.length; index += 1) {
+    const character = value[index]
+    if (depth > 0 && expansionStarts(value, index)) return 'an array subscript with an expansion'
+    if (quote === "'") {
+      if (character === "'") quote = undefined
+    } else if (character === '\\') {
+      index += 1
+      if (depth > 0 && expansionStarts(value, index)) return 'an array subscript with an expansion'
+    } else if (quote === '"') {
+      if (character === '"') quote = undefined
+    } else if (depth > 0 && (character === '"' || character === "'")) {
+      quote = character
+    } else if (character === '[') {
+      depth += 1
+    } else if (character === ']') {
+      if (depth === 0) return 'an unbalanced array subscript'
+      depth -= 1
+    }
+  }
+  return depth > 0 || quote ? 'an unbalanced array subscript' : undefined
+}
+
 function isLegacyShellPlaceholder(occurrence: CodePlaceholderOccurrence): boolean {
   const inner = occurrence.raw.slice(2, -2)
   return inner.trim() === occurrence.name && SHELL_BARE_NAME.test(occurrence.name)
@@ -756,12 +797,14 @@ function collectShellOccurrenceContexts<T extends ShellSpan>(
   /** A subscript frame for `name`'s array: a string key for an associative array, else an arithmetic index. */
   const subscriptFrameFor = (name: string | undefined) =>
     subscriptFrame(isAssociativeArray(name ?? '') ? 'keysubscript' : 'arithmetic')
-  /** Forget a name's tracked type in every scope — on `unset`, or a re-declaration that changes it. */
+  /** Forget a name's tracked array type in every scope — a re-declaration as `-a`/`-A` resets it. */
+  const clearArrayType = (name: string) => {
+    for (const frame of frames) frame.associativeArrays?.delete(name)
+  }
+  /** Forget everything tracked about a name in every scope — `unset` removes its attributes too. */
   const clearNameType = (name: string) => {
-    for (const frame of frames) {
-      frame.associativeArrays?.delete(name)
-      frame.integerAttribute?.delete(name)
-    }
+    clearArrayType(name)
+    for (const frame of frames) frame.integerAttribute?.delete(name)
   }
   /** Whether a `>`/`<` redirect operator immediately precedes `at`, across any intervening blanks. */
   const precededByRedirect = (at: number): boolean => {
@@ -895,19 +938,23 @@ function collectShellOccurrenceContexts<T extends ShellSpan>(
     ) {
       const declared = SHELL_NAME.exec(word)?.[0]
       if (declared) {
-        // A re-declaration resets the name's type before this one's attributes apply, so a later
-        // `declare -a` (indexed) clears an earlier `-A` (associative) and vice versa.
-        if (command.associativeOption || command.indexedOption) clearNameType(declared)
+        // A re-declaration resets the name's array type before this one's attributes apply, so a
+        // later `declare -a` (indexed) clears an earlier `-A` (associative) and vice versa. The
+        // integer attribute survives it — only `+i` or `unset` removes that.
+        if (command.associativeOption || command.indexedOption) clearArrayType(declared)
         if (command.associativeOption) (frame.associativeArrays ??= new Set()).add(declared)
         if (command.integerOption) {
           ;(frame.integerAttribute ??= new Map()).set(declared, command.integerOption === 'set')
         }
       }
     }
     // `unset name` removes the variable and its attributes, so a later indexed reuse is arithmetic
-    // again. A bare name only — `unset name[i]` removes one element, not the array's type.
-    if (command.nameArgumentBuiltin && command.sawCommandWord && SHELL_BARE_NAME.test(word)) {
-      clearNameType(word)
+    // again. A bare name only — `unset name[i]` removes one element, not the array's type — and not
+    // under `-f`, which removes a function of that name and leaves the variable alone.
+    if (command.nameArgumentBuiltin && command.sawCommandWord) {
+      const option = DECLARATION_OPTION.exec(word)
+      if (option?.[1] === '-' && option[2].includes('f')) command.unsetsFunctions = true
+      else if (!command.unsetsFunctions && SHELL_BARE_NAME.test(word)) clearNameType(word)
     }
     // An assignment is one only in command-prefix or declaration-argument position; `echo n=1` or
     // `printf a[i]=1` passes an ordinary string that bash never evaluates.
@@ -1435,6 +1482,14 @@ export async function compileShellPlaceholders(
         occurrence.start
       )
     }
+    const unsafeSubscript = resolved && unsafeArithmeticSubscript(resolved.value)
+    if (unsafeSubscript && !input.analysisOnly) {
+      throw new CodePlaceholderCompileError(
+        `Variable placeholder "${occurrence.name}" cannot contain ${unsafeSubscript} in shell code`,
+        input.code,
+        occurrence.start
+      )
+    }
     return resolved
   }
   const resolveShellOccurrence = (occurrence: CodePlaceholderOccurrence) =>