@scriptc/runtime 0.0.22 → 0.0.24

package/src/scr_lib.c

@@ -49,13 +49,14 @@
 #include <ws2tcpip.h> /* inet_ntop, sockaddr_in6 */
 #include <iphlpapi.h> /* GetAdaptersAddresses (os.networkInterfaces) */
 #include <windows.h>
+#include <winioctl.h> /* FSCTL_GET_REPARSE_POINT */
 #include <lmcons.h>  /* UNLEN for GetUserNameA */
+#include "scr_win_stats.h"
 
 
-/* CRT stat has no symlink view — lstat degrades to stat (divergence: a
- * compiled binary never reports isSymbolicLink() true on Windows; Node
- * does for real symlinks/junctions). Mechanical fix: GetFileAttributesW +
- * FILE_ATTRIBUTE_REPARSE_POINT. */
+/* The CRT has no symlink view, so its internal lstat users degrade to stat.
+ * The public Stats path below bypasses this seam and opens the final component
+ * as a reparse point for lstatSync, matching Node's no-follow split. */
 #define lstat stat
 
 /* Windows has no directory mode bits; the CRT mkdir takes one argument. */
@@ -76,6 +77,7 @@
 #include <ifaddrs.h>
 #include <net/if.h>
 #include <netinet/in.h>
+#include <pthread.h>
 #include <pwd.h>
 #include <sys/ioctl.h>
 #include <sys/socket.h>
@@ -1111,6 +1113,23 @@ static double scr_filetime_us(FILETIME ft) {
   v.HighPart = ft.dwHighDateTime;
   return (double)(v.QuadPart / 10);
 }
+
+/* A filesystem FILETIME is 100ns ticks since 1601. Match libuv's split into
+ * Unix seconds + nanoseconds before doing Node's millisecond arithmetic; the
+ * split matters for the last-bit rounding of dates far from the epoch. */
+static double scr_filetime_unix_ms(FILETIME ft) {
+  ULARGE_INTEGER raw;
+  raw.LowPart = ft.dwLowDateTime;
+  raw.HighPart = ft.dwHighDateTime;
+  int64_t ticks = (int64_t)raw.QuadPart - INT64_C(116444736000000000);
+  int64_t sec = ticks / INT64_C(10000000);
+  int64_t rem = ticks % INT64_C(10000000);
+  if (rem < 0) {
+    sec--;
+    rem += INT64_C(10000000);
+  }
+  return (double)sec * 1000.0 + (double)rem / 10000.0;
+}
 double scr_cpu_user(void) {
   FILETIME c, e, k, u;
   if (!GetProcessTimes(GetCurrentProcess(), &c, &e, &k, &u)) return 0;
@@ -1380,11 +1399,23 @@ static const char *scr_errno_name(int e, char *fallback, size_t cap) {
   case ENOENT: return "ENOENT";
   case EEXIST: return "EEXIST";
   case EACCES: return "EACCES";
+  case EBUSY: return "EBUSY";
+  case EINVAL: return "EINVAL";
+  case EIO: return "EIO";
+  case ENAMETOOLONG: return "ENAMETOOLONG";
+  case ENOMEM: return "ENOMEM";
+  case ENOSPC: return "ENOSPC";
   case ENOTDIR: return "ENOTDIR";
   case EISDIR: return "EISDIR";
   case ENOTEMPTY: return "ENOTEMPTY";
   case EPERM: return "EPERM";
+  case EROFS: return "EROFS";
+  case EXDEV: return "EXDEV";
   case EBADF: return "EBADF";
+  case EAGAIN: return "EAGAIN";
+  case EFBIG: return "EFBIG";
+  case EPIPE: return "EPIPE";
+  case ESPIPE: return "ESPIPE";
   default:
     snprintf(fallback, cap, "E%d", e);
     return fallback;
@@ -1396,11 +1427,23 @@ static const char *scr_errno_text(int e) {
   case ENOENT: return "no such file or directory";
   case EEXIST: return "file already exists";
   case EACCES: return "permission denied";
+  case EBUSY: return "resource busy or locked";
+  case EINVAL: return "invalid argument";
+  case EIO: return "i/o error";
+  case ENAMETOOLONG: return "name too long";
+  case ENOMEM: return "not enough memory";
+  case ENOSPC: return "no space left on device";
   case ENOTDIR: return "not a directory";
   case EISDIR: return "illegal operation on a directory";
   case ENOTEMPTY: return "directory not empty";
   case EPERM: return "operation not permitted";
+  case EROFS: return "read-only file system";
+  case EXDEV: return "cross-device link not permitted";
   case EBADF: return "bad file descriptor";
+  case EAGAIN: return "resource temporarily unavailable";
+  case EFBIG: return "file too large";
+  case EPIPE: return "broken pipe";
+  case ESPIPE: return "invalid seek";
   default: return strerror(e);
   }
 }
@@ -1542,6 +1585,22 @@ void scr_fs_write_file(ScrStr *path, ScrStr *data) {
  * existing file keeps its permissions, exactly Node (which never chmods
  * here). Same error shapes as the plain form. */
 void scr_fs_write_file_mode(ScrStr *path, ScrStr *data, double mode) {
+  char recv[48], msg[176];
+  scr_num_received(mode, recv);
+  if (!(isfinite(mode) && trunc(mode) == mode)) {
+    int len = snprintf(msg, sizeof msg,
+                       "The value of \"mode\" is out of range. It must be an integer. Received %s",
+                       recv);
+    scr_throw_error_msg_code(SCR_ERR_RANGE, msg, (size_t)len, "ERR_OUT_OF_RANGE");
+    return;
+  }
+  if (mode < 0 || mode > 4294967295.0) {
+    int len = snprintf(msg, sizeof msg,
+                       "The value of \"mode\" is out of range. It must be >= 0 && <= 4294967295. Received %s",
+                       recv);
+    scr_throw_error_msg_code(SCR_ERR_RANGE, msg, (size_t)len, "ERR_OUT_OF_RANGE");
+    return;
+  }
   /* O_BINARY: zero on POSIX; on Windows it keeps the CRT from translating
    * \n in these byte-exact writes (fopen's "wb" path already does). */
   int fd = open(path->data, O_WRONLY | O_CREAT | O_TRUNC | O_BINARY, (mode_t)mode);
@@ -1646,12 +1705,321 @@ double scr_fs_open(ScrStr *path, ScrStr *flags) {
 
 /* fs.closeSync(fd) — close(2); failure throws Node's path-less fs error
  * shape ("EBADF: bad file descriptor, close"). */
-/* fs.readSync(fd, buffer, offset, length) — the 4-argument buffer form.
+
+/* Offset-preserving read for fs.readSync's numeric-position form. POSIX
+ * supplies pread(2). Windows follows libuv's synchronous-handle recipe:
+ * ReadFile with an OVERLAPPED byte offset, then restore the handle position
+ * because synchronous ReadFile updates it even when OVERLAPPED is present. */
+static ssize_t scr_fs_pread(int fd, void *data, size_t length, double position) {
+#ifdef _WIN32
+  HANDLE handle = (HANDLE)_get_osfhandle(fd);
+  if (handle == INVALID_HANDLE_VALUE) {
+    errno = EBADF;
+    return -1;
+  }
+
+  OVERLAPPED overlapped;
+  memset(&overlapped, 0, sizeof overlapped);
+  LARGE_INTEGER at;
+  at.QuadPart = (LONGLONG)position;
+  overlapped.Offset = at.LowPart;
+  overlapped.OffsetHigh = at.HighPart;
+
+  LARGE_INTEGER zero;
+  LARGE_INTEGER original;
+  zero.QuadPart = 0;
+  BOOL restore = SetFilePointerEx(handle, zero, &original, FILE_CURRENT);
+  DWORD got = 0;
+  DWORD want = length > (size_t)UINT32_MAX ? UINT32_MAX : (DWORD)length;
+  BOOL ok = ReadFile(handle, data, want, &got, &overlapped);
+  DWORD error = ok ? ERROR_SUCCESS : GetLastError();
+  if (restore) (void)SetFilePointerEx(handle, original, NULL, FILE_BEGIN);
+  /* ReadFile may report a terminal status after still filling part of the
+   * caller's buffer (notably ERROR_MORE_DATA for a message-mode pipe).
+   * libuv/Node return those bytes and surface the status on the next read. */
+  if (ok || got > 0 || error == ERROR_HANDLE_EOF || error == ERROR_BROKEN_PIPE) {
+    return (ssize_t)got;
+  }
+
+  /* The read-specific subset of libuv's Win32-to-errno translation. */
+  switch (error) {
+    case ERROR_INVALID_HANDLE:
+    case ERROR_ACCESS_DENIED:
+      errno = EBADF;
+      break;
+    case ERROR_INVALID_FUNCTION:
+    case ERROR_INVALID_PARAMETER:
+      errno = EINVAL;
+      break;
+    case ERROR_NOT_ENOUGH_MEMORY:
+    case ERROR_OUTOFMEMORY:
+      errno = ENOMEM;
+      break;
+    case ERROR_OPERATION_ABORTED:
+      errno = EINTR;
+      break;
+    default:
+      errno = EIO;
+      break;
+  }
+  return -1;
+#else
+  return pread(fd, data, length, (off_t)position);
+#endif
+}
+
+/* Offset-preserving write for fs.writeSync's numeric-position forms. The
+ * Windows arm mirrors scr_fs_pread: WriteFile receives an OVERLAPPED offset
+ * and the CRT descriptor's current position is restored before returning. */
+static ssize_t scr_fs_pwrite(int fd, const void *data, size_t length, double position) {
+#ifdef _WIN32
+  HANDLE handle = (HANDLE)_get_osfhandle(fd);
+  if (handle == INVALID_HANDLE_VALUE) {
+    errno = EBADF;
+    return -1;
+  }
+
+  OVERLAPPED overlapped;
+  memset(&overlapped, 0, sizeof overlapped);
+  LARGE_INTEGER at;
+  at.QuadPart = (LONGLONG)position;
+  overlapped.Offset = at.LowPart;
+  overlapped.OffsetHigh = at.HighPart;
+
+  LARGE_INTEGER zero;
+  LARGE_INTEGER original;
+  zero.QuadPart = 0;
+  BOOL restore = SetFilePointerEx(handle, zero, &original, FILE_CURRENT);
+  DWORD wrote = 0;
+  DWORD want = length > (size_t)UINT32_MAX ? UINT32_MAX : (DWORD)length;
+  BOOL ok = WriteFile(handle, data, want, &wrote, &overlapped);
+  DWORD error = ok ? ERROR_SUCCESS : GetLastError();
+  if (restore) (void)SetFilePointerEx(handle, original, NULL, FILE_BEGIN);
+  if (ok || wrote > 0) return (ssize_t)wrote;
+
+  switch (error) {
+    case ERROR_INVALID_HANDLE:
+    case ERROR_ACCESS_DENIED:
+      errno = EBADF;
+      break;
+    case ERROR_INVALID_FUNCTION:
+    case ERROR_INVALID_PARAMETER:
+      errno = EINVAL;
+      break;
+    case ERROR_DISK_FULL:
+    case ERROR_HANDLE_DISK_FULL:
+      errno = ENOSPC;
+      break;
+    case ERROR_FILE_TOO_LARGE:
+      errno = EFBIG;
+      break;
+    case ERROR_BROKEN_PIPE:
+    case ERROR_NO_DATA:
+      errno = EPIPE;
+      break;
+    case ERROR_NOT_ENOUGH_MEMORY:
+    case ERROR_OUTOFMEMORY:
+      errno = ENOMEM;
+      break;
+    case ERROR_OPERATION_ABORTED:
+      errno = EINTR;
+      break;
+    default:
+      errno = EIO;
+      break;
+  }
+  return -1;
+#else
+  return pwrite(fd, data, length, (off_t)position);
+#endif
+}
+
+static bool scr_fs_write_fd_valid(double fd) {
+  char msg[160];
+  char recv[48];
+  scr_num_received(fd, recv);
+  if (!(isfinite(fd) && trunc(fd) == fd)) {
+    int len = snprintf(msg, sizeof msg,
+                       "The value of \"fd\" is out of range. It must be an integer. Received %s",
+                       recv);
+    scr_throw_error_msg_code(SCR_ERR_RANGE, msg, (size_t)len, "ERR_OUT_OF_RANGE");
+    return false;
+  }
+  if (fd < 0 || fd > 2147483647.0) {
+    int len = snprintf(msg, sizeof msg,
+                       "The value of \"fd\" is out of range. It must be >= 0 && <= 2147483647. Received %s",
+                       recv);
+    scr_throw_error_msg_code(SCR_ERR_RANGE, msg, (size_t)len, "ERR_OUT_OF_RANGE");
+    return false;
+  }
+  return true;
+}
+
+/* write(2) raises SIGPIPE before returning EPIPE when a pipe/socket peer has
+ * closed; write(2)/pwrite(2) likewise raise SIGXFSZ before returning EFBIG at
+ * RLIMIT_FSIZE. Node turns both into catchable fs errors. Do the same per
+ * calling thread rather than changing process dispositions (which spawned
+ * children would inherit). Consume only a signal freshly generated by this
+ * call, preserving any signal that was already pending. */
+static ssize_t scr_fs_write_once(int fd, const void *data, size_t length,
+                                 bool positioned, double position) {
+#ifdef _WIN32
+  return positioned
+    ? scr_fs_pwrite(fd, data, length, position)
+    : write(fd, data, length);
+#else
+  sigset_t write_set, old_set, pending;
+  sigemptyset(&write_set);
+#ifdef SIGPIPE
+  sigaddset(&write_set, SIGPIPE);
+#endif
+#ifdef SIGXFSZ
+  sigaddset(&write_set, SIGXFSZ);
+#endif
+  if (pthread_sigmask(SIG_BLOCK, &write_set, &old_set) != 0) {
+    return positioned
+      ? scr_fs_pwrite(fd, data, length, position)
+      : write(fd, data, length);
+  }
+
+  bool pending_known = sigpending(&pending) == 0;
+#ifdef SIGPIPE
+  bool had_pipe = pending_known && sigismember(&pending, SIGPIPE) == 1;
+#endif
+#ifdef SIGXFSZ
+  bool had_xfsz = pending_known && sigismember(&pending, SIGXFSZ) == 1;
+#endif
+  ssize_t n = positioned
+    ? scr_fs_pwrite(fd, data, length, position)
+    : write(fd, data, length);
+  int write_errno = errno;
+
+  int generated = 0;
+  if (n < 0 && pending_known && sigpending(&pending) == 0) {
+#ifdef SIGPIPE
+    if (write_errno == EPIPE && !had_pipe && sigismember(&pending, SIGPIPE) == 1) {
+      generated = SIGPIPE;
+    }
+#endif
+#ifdef SIGXFSZ
+    if (write_errno == EFBIG && !had_xfsz && sigismember(&pending, SIGXFSZ) == 1) {
+      generated = SIGXFSZ;
+    }
+#endif
+  }
+  if (generated != 0) {
+    sigset_t generated_set;
+    sigemptyset(&generated_set);
+    sigaddset(&generated_set, generated);
+    int caught = 0;
+    int wait_err;
+    do {
+      wait_err = sigwait(&generated_set, &caught);
+    } while (wait_err == EINTR);
+  }
+
+  (void)pthread_sigmask(SIG_SETMASK, &old_set, NULL);
+  errno = write_errno;
+  return n;
+#endif
+}
+
+static double scr_fs_write_bytes(double fd, const void *data, size_t length,
+                                 double position) {
+  if (!scr_fs_write_fd_valid(fd)) return 0;
+  /* Node/libuv treats every position other than a safe nonnegative integer
+   * as the current-offset sentinel for writes (unlike readSync, it does not
+   * throw for negative/fractional positions). */
+  bool positioned = isfinite(position) && trunc(position) == position &&
+                    position >= 0 && position <= 9007199254740991.0;
+  ssize_t n;
+  do {
+    n = scr_fs_write_once((int)fd, data, length, positioned, position);
+  } while (n < 0 && errno == EINTR);
+  if (n < 0) {
+    int e = errno;
+    char namebuf[16];
+    const char *name = scr_errno_name(e, namebuf, sizeof namebuf);
+    const char *text = scr_errno_text(e);
+    char msg[160];
+    int len = snprintf(msg, sizeof msg, "%s: %s, write", name, text);
+    scr_throw_error_msg_code(SCR_ERR_ERROR, msg, (size_t)len, name);
+    return 0;
+  }
+  return (double)n;
+}
+
+/* fs.writeSync(fd, buffer, offset, length[, position]) — validates the
+ * caller window before touching the descriptor, then submits one write like
+ * Node/libuv. Positioned writes do not advance the descriptor. */
+double scr_fs_write_sync(double fd, ScrBytes *buf, double offset, double length,
+                         double position) {
+  size_t bytelen = buf->len; /* frontend admits u8 buffers only */
+  char msg[160];
+  char recv[48];
+  scr_num_received(offset, recv);
+  if (!(isfinite(offset) && trunc(offset) == offset)) {
+    int len = snprintf(msg, sizeof msg,
+                       "The value of \"offset\" is out of range. It must be an integer. Received %s",
+                       recv);
+    scr_throw_error_msg_code(SCR_ERR_RANGE, msg, (size_t)len, "ERR_OUT_OF_RANGE");
+    return 0;
+  }
+  if (offset < 0 || offset > 9007199254740991.0) {
+    int len = snprintf(msg, sizeof msg,
+                       "The value of \"offset\" is out of range. It must be >= 0 && <= 9007199254740991. Received %s",
+                       recv);
+    scr_throw_error_msg_code(SCR_ERR_RANGE, msg, (size_t)len, "ERR_OUT_OF_RANGE");
+    return 0;
+  }
+  if (offset > (double)bytelen) {
+    int len = snprintf(msg, sizeof msg,
+                       "The value of \"offset\" is out of range. It must be <= %zu. Received %s",
+                       bytelen, recv);
+    scr_throw_error_msg_code(SCR_ERR_RANGE, msg, (size_t)len, "ERR_OUT_OF_RANGE");
+    return 0;
+  }
+
+  scr_num_received(length, recv);
+  if (length < 0) {
+    int len = snprintf(msg, sizeof msg,
+                       "The value of \"length\" is out of range. It must be >= 0. Received %s",
+                       recv);
+    scr_throw_error_msg_code(SCR_ERR_RANGE, msg, (size_t)len, "ERR_OUT_OF_RANGE");
+    return 0;
+  }
+  size_t off = (size_t)offset;
+  if (length > (double)(bytelen - off)) {
+    int len = snprintf(msg, sizeof msg,
+                       "The value of \"length\" is out of range. It must be <= %zu. Received %s",
+                       bytelen - off, recv);
+    scr_throw_error_msg_code(SCR_ERR_RANGE, msg, (size_t)len, "ERR_OUT_OF_RANGE");
+    return 0;
+  }
+  if (!(isfinite(length) && trunc(length) == length)) {
+    int len = snprintf(msg, sizeof msg,
+                       "The value of \"length\" is out of range. It must be an integer. Received %s",
+                       recv);
+    scr_throw_error_msg_code(SCR_ERR_RANGE, msg, (size_t)len, "ERR_OUT_OF_RANGE");
+    return 0;
+  }
+  return scr_fs_write_bytes(fd, buf->data + off, (size_t)length, position);
+}
+
+double scr_fs_write_str_sync(double fd, ScrStr *data, double position,
+                             ScrStr *encoding) {
+  (void)encoding; /* frontend proves utf8; the argument still evaluates */
+  return scr_fs_write_bytes(fd, data->data, data->len, position);
+}
+
+/* fs.readSync(fd, buffer, offset, length[, position]) — the buffer form.
  * Node validates offset/length against the buffer before reading and
  * throws ERR_OUT_OF_RANGE; here the checks clamp to the same contract and
- * throw the RangeError shape. Returns the byte count read(2) reports;
- * errors carry the errno name like the other fd operations. */
-double scr_fs_read_sync(double fd, ScrBytes *buf, double offset, double length) {
+ * throw the RangeError shape. Position -1 means the fd's current offset;
+ * nonnegative positions do not advance it. Returns the byte count the OS
+ * reports; errors carry the errno name like the other fd operations. */
+double scr_fs_read_sync(double fd, ScrBytes *buf, double offset, double length,
+                        double position) {
   size_t bytelen = buf->len; /* u8 buffers: elem count == byte count */
   char msg[160];
   int mlen;
@@ -1659,7 +2027,28 @@ double scr_fs_read_sync(double fd, ScrBytes *buf, double offset, double length)
    * form, length against the remaining window (validateOffset vs the
    * buffer-bounds check in fs.readSync). */
   char numbuf[40];
-  if (offset < 0 || offset > (double)bytelen) {
+  if (!(isfinite(offset) && trunc(offset) == offset)) {
+    char recv[48];
+    scr_num_received(offset, recv);
+    mlen = snprintf(msg, sizeof msg,
+                    "The value of \"offset\" is out of range. It must be an integer. Received %s",
+                    recv);
+    scr_throw_error_msg_code(SCR_ERR_RANGE, msg, (size_t)mlen, "ERR_OUT_OF_RANGE");
+    return 0;
+  }
+  if (offset < 0 || offset > 9007199254740991.0) {
+    numbuf[scr_f64_to_str(offset, numbuf)] = 0;
+    mlen = snprintf(msg, sizeof msg,
+                    "The value of \"offset\" is out of range. It must be >= 0 && <= 9007199254740991. Received %s",
+                    numbuf);
+    scr_throw_error_msg_code(SCR_ERR_RANGE, msg, (size_t)mlen, "ERR_OUT_OF_RANGE");
+    return 0;
+  }
+  /* Node returns after offset's intrinsic validation when the requested
+   * length normalizes to zero: buffer-window bounds, position, and fd are
+   * not consulted. Preserve the existing size_t coercion's [0, 1) case. */
+  if (length >= 0 && length < 1) return 0;
+  if (offset > (double)bytelen) {
     numbuf[scr_f64_to_str(offset, numbuf)] = 0;
     mlen = snprintf(msg, sizeof msg,
                     "The value of \"offset\" is out of range. It must be >= 0 && <= 9007199254740991. Received %s",
@@ -1677,7 +2066,27 @@ double scr_fs_read_sync(double fd, ScrBytes *buf, double offset, double length)
     return 0;
   }
   size_t want = (size_t)length;
-  ssize_t n = read((int)fd, buf->data + off, want);
+  if (!(isfinite(position) && trunc(position) == position)) {
+    char recv[48];
+    scr_num_received(position, recv);
+    mlen = snprintf(msg, sizeof msg,
+                    "The value of \"position\" is out of range. It must be an integer. Received %s",
+                    recv);
+    scr_throw_error_msg_code(SCR_ERR_RANGE, msg, (size_t)mlen, "ERR_OUT_OF_RANGE");
+    return 0;
+  }
+  if (position < -1 || position > 9007199254740991.0) {
+    char recv[48];
+    scr_num_received(position, recv);
+    mlen = snprintf(msg, sizeof msg,
+                    "The value of \"position\" is out of range. It must be >= -1 && <= 9007199254740991. Received %s",
+                    recv);
+    scr_throw_error_msg_code(SCR_ERR_RANGE, msg, (size_t)mlen, "ERR_OUT_OF_RANGE");
+    return 0;
+  }
+  ssize_t n = position == -1
+    ? read((int)fd, buf->data + off, want)
+    : scr_fs_pread((int)fd, buf->data + off, want, position);
   if (n < 0) {
     int e = errno;
     char namebuf[16];
@@ -1778,11 +2187,110 @@ void scr_fs_copyfile(ScrStr *src, ScrStr *dest) {
 }
 
 /* renameSync(old, new): rename(2), Node's two-path error shape ("ENOENT:
- * no such file or directory, rename 'a' -> 'b'"). */
-void scr_fs_rename(ScrStr *oldpath, ScrStr *newpath) {
-  if (rename(oldpath->data, newpath->data) != 0) {
-    scr_fs_throw2(errno, "rename", oldpath, newpath);
+ * no such file or directory, rename 'a' -> 'b'"). Windows must bypass
+ * the CRT's rename(): it refuses an existing destination and cannot move
+ * directories between parents, while Node/libuv uses MoveFileExW with
+ * MOVEFILE_REPLACE_EXISTING. Runtime strings are UTF-8, so feed the wide
+ * Win32 API rather than the active-code-page `A` form. */
+#ifdef _WIN32
+static WCHAR *scr_fs_win_wide(const ScrStr *path) {
+  if (path->len > INT_MAX) {
+    SetLastError(ERROR_FILENAME_EXCED_RANGE);
+    return NULL;
+  }
+  int n = path->len > 0
+    ? MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS,
+                          path->data, (int)path->len, NULL, 0)
+    : 0;
+  if (path->len > 0 && n == 0) return NULL;
+  WCHAR *wide = malloc(((size_t)n + 1) * sizeof *wide);
+  if (!wide) {
+    SetLastError(ERROR_NOT_ENOUGH_MEMORY);
+    return NULL;
   }
+  if (n > 0) {
+    (void)MultiByteToWideChar(CP_UTF8, MB_ERR_INVALID_CHARS,
+                              path->data, (int)path->len, wide, n);
+  }
+  wide[n] = L'\0';
+  return wide;
+}
+
+/* The reachable fs subset of libuv's uv_translate_sys_error table. */
+static int scr_fs_win_errno(DWORD error) {
+  switch (error) {
+  case ERROR_ALREADY_EXISTS:
+  case ERROR_FILE_EXISTS:
+    return EEXIST;
+  case ERROR_LOCK_VIOLATION:
+  case ERROR_PIPE_BUSY:
+  case ERROR_SHARING_VIOLATION:
+    return EBUSY;
+  case ERROR_INVALID_FUNCTION:
+    return EISDIR;
+  case ERROR_INSUFFICIENT_BUFFER:
+  case ERROR_INVALID_DATA:
+  case ERROR_INVALID_PARAMETER:
+    return EINVAL;
+  case ERROR_BUFFER_OVERFLOW:
+  case ERROR_FILENAME_EXCED_RANGE:
+    return ENAMETOOLONG;
+  case ERROR_NOT_ENOUGH_MEMORY:
+  case ERROR_OUTOFMEMORY:
+    return ENOMEM;
+  case ERROR_CANNOT_MAKE:
+  case ERROR_DISK_FULL:
+  case ERROR_HANDLE_DISK_FULL:
+    return ENOSPC;
+  case ERROR_DIR_NOT_EMPTY:
+    return ENOTEMPTY;
+  case ERROR_ACCESS_DENIED:
+  case ERROR_PRIVILEGE_NOT_HELD:
+    return EPERM;
+  case ERROR_WRITE_PROTECT:
+    return EROFS;
+  case ERROR_NOT_SAME_DEVICE:
+    return EXDEV;
+  case ERROR_BAD_PATHNAME:
+  case ERROR_DIRECTORY:
+  case ERROR_FILE_NOT_FOUND:
+  case ERROR_INVALID_DRIVE:
+  case ERROR_INVALID_NAME:
+  case ERROR_PATH_NOT_FOUND:
+    return ENOENT;
+  default:
+    return EIO;
+  }
+}
+#endif
+
+int scr_fs_rename_raw(const ScrStr *oldpath, const ScrStr *newpath) {
+#ifdef _WIN32
+  WCHAR *oldwide = scr_fs_win_wide(oldpath);
+  if (!oldwide) return scr_fs_win_errno(GetLastError());
+  WCHAR *newwide = scr_fs_win_wide(newpath);
+  if (!newwide) {
+    DWORD error = GetLastError();
+    free(oldwide);
+    return scr_fs_win_errno(error);
+  }
+  BOOL ok = MoveFileExW(oldwide, newwide, MOVEFILE_REPLACE_EXISTING);
+  DWORD error = ok ? ERROR_SUCCESS : GetLastError();
+  free(oldwide);
+  free(newwide);
+  return ok ? 0 : scr_fs_win_errno(error);
+#else
+  return rename(oldpath->data, newpath->data) == 0 ? 0 : errno;
+#endif
+}
+
+void scr_fs_rename_error(int error, const ScrStr *oldpath, const ScrStr *newpath) {
+  scr_fs_throw2(error, "rename", oldpath, newpath);
+}
+
+void scr_fs_rename(ScrStr *oldpath, ScrStr *newpath) {
+  int error = scr_fs_rename_raw(oldpath, newpath);
+  if (error != 0) scr_fs_rename_error(error, oldpath, newpath);
 }
 
 void scr_fs_rm(ScrStr *path) {
@@ -2070,7 +2578,7 @@ static void scr_fs_throw_nopath(int e, const char *op) {
   const char *text = scr_errno_text(e);
   char msg[256];
   int len = snprintf(msg, sizeof msg, "%s: %s, %s", name, text, op);
-  scr_throw_error_msg(SCR_ERR_ERROR, msg, (size_t)len);
+  scr_throw_error_msg_code(SCR_ERR_ERROR, msg, (size_t)len, name);
 }
 
 /* read(2) loop to EOF from the CURRENT position — Node's
@@ -2261,8 +2769,8 @@ void scr_process_stdin_destroy(void) {
 }
 
 /* ── Stats values ────────────────────────────────────────────────────
- * An immutable snapshot of stat(2) results — the slice the lowered
- * surface exposes (isFile/isDirectory/size). statSync THROWS like the
+ * An immutable snapshot of stat(2) results — the lowered type/mode, size,
+ * allocation/link, and access/write-time slice. statSync THROWS like the
  * other sync fs calls; the promise form rejects (see the fsp section). */
 
 struct ScrStats {
@@ -2271,6 +2779,9 @@ struct ScrStats {
   bool is_dir;
   bool is_symlink; /* lstat only — a followed stat never sees one */
   double size;
+  double blocks;   /* allocated size in 512-byte units (Node/libuv) */
+  double nlink;
+  double atime_ms;
   double mtime_ms; /* milliseconds with the nanosecond fraction (Node) */
 };
 
@@ -2291,53 +2802,310 @@ bool scr_stats_is_file(ScrStats *s) { return s->is_file; }
 bool scr_stats_is_dir(ScrStats *s) { return s->is_dir; }
 bool scr_stats_is_symlink(ScrStats *s) { return s->is_symlink; }
 double scr_stats_size(ScrStats *s) { return s->size; }
+double scr_stats_blocks(ScrStats *s) { return s->blocks; }
+double scr_stats_nlink(ScrStats *s) { return s->nlink; }
+double scr_stats_atime_ms(ScrStats *s) { return s->atime_ms; }
 double scr_stats_mtime_ms(ScrStats *s) { return s->mtime_ms; }
 
-static ScrStats *scr_stats_of(const struct stat *st) {
+static ScrStats *scr_stats_new(void) {
   ScrStats *s = malloc(sizeof(ScrStats));
   if (!s) {
     scr_trap("scriptc: out of memory\n");
   }
   s->rc = 1;
+  return s;
+}
+
+#ifdef _WIN32
+/* The CRT fallback is deliberately complete: callers either get every field
+ * from this one stat() result or every field from one Win32 handle below,
+ * never a snapshot spliced across two path resolutions. */
+static ScrStats *scr_stats_of_crt(const struct stat *st) {
+  ScrStats *s = scr_stats_new();
   s->is_file = S_ISREG(st->st_mode);
   s->is_dir = S_ISDIR(st->st_mode);
-#if defined(_WIN32)
-  /* CRT stat has no symlink view (lstat above degrades to stat) and no
-   * sub-second mtime — whole seconds where Node reads the FILETIME's
-   * 100ns units (divergence: mtimeMs precision; mechanical fix is
-   * GetFileAttributesEx). */
   s->is_symlink = false;
+  s->size = (double)st->st_size;
+  s->blocks = st->st_size <= 0 ? 0.0 : (double)(((uint64_t)st->st_size + 511) >> 9);
+  s->nlink = (double)st->st_nlink;
+  s->atime_ms = (double)st->st_atime * 1000.0;
   s->mtime_ms = (double)st->st_mtime * 1000.0;
+  return s;
+}
+
+static ScrStats *scr_stats_crt_fallback(const ScrStr *path, const char *op) {
+  struct stat st;
+  if (stat(path->data, &st) != 0) {
+    scr_fs_throw(errno, op, path);
+    return NULL;
+  }
+  return scr_stats_of_crt(&st);
+}
+
+/* Resolve ordinary disk paths once and populate every public field from the
+ * resulting handle. Splitting size/type across CRT stat() and a later
+ * CreateFile call can mix two entries when another process replaces path. */
+static bool scr_stats_is_link_tag(DWORD tag) {
+  return tag == IO_REPARSE_TAG_SYMLINK ||
+         tag == IO_REPARSE_TAG_MOUNT_POINT ||
+         tag == IO_REPARSE_TAG_APPEXECLINK ||
+         tag == UINT32_C(0xA000001D); /* IO_REPARSE_TAG_LX_SYMLINK */
+}
+
+static double scr_stats_utf16_len(const WCHAR *text, size_t len) {
+  if (len == 0) return 0;
+  if (len > INT_MAX) return -1;
+  int bytes = WideCharToMultiByte(
+    CP_UTF8, 0, text, (int)len, NULL, 0, NULL, NULL);
+  return bytes > 0 ? (double)bytes : -1;
+}
+
+typedef struct {
+  ULONG tag;
+  USHORT data_len;
+  USHORT reserved;
+  union {
+    struct {
+      USHORT substitute_offset;
+      USHORT substitute_len;
+      USHORT print_offset;
+      USHORT print_len;
+      ULONG flags;
+      WCHAR path[1];
+    } symlink;
+    struct {
+      USHORT substitute_offset;
+      USHORT substitute_len;
+      USHORT print_offset;
+      USHORT print_len;
+      WCHAR path[1];
+    } mount;
+    struct {
+      unsigned char bytes[1];
+    } generic;
+  } body;
+} ScrStatsReparseData;
+
+/* Node/libuv reports a Windows link's target-text length as st_size. The
+ * ordinary handle information does not carry that value, so read the reparse
+ * payload while the no-follow handle is live. */
+static bool scr_stats_link_size(HANDLE h, DWORD tag, double *size_out) {
+  union {
+    ScrStatsReparseData align;
+    unsigned char bytes[MAXIMUM_REPARSE_DATA_BUFFER_SIZE];
+  } storage;
+  DWORD used;
+  if (!DeviceIoControl(h, FSCTL_GET_REPARSE_POINT, NULL, 0,
+                       storage.bytes, sizeof storage.bytes, &used, NULL)) return false;
+  ScrStatsReparseData *data = (ScrStatsReparseData *)storage.bytes;
+  const size_t body_offset = offsetof(ScrStatsReparseData, body);
+  if (used < body_offset || data->data_len > used - body_offset ||
+      data->tag != tag) return false;
+
+  const WCHAR *target;
+  size_t len;
+  if (tag == IO_REPARSE_TAG_SYMLINK) {
+    const size_t fixed = offsetof(ScrStatsReparseData, body.symlink.path) -
+      body_offset;
+    size_t offset = data->body.symlink.substitute_offset;
+    size_t bytes = data->body.symlink.substitute_len;
+    if (data->data_len < fixed || ((offset | bytes) & 1) != 0 ||
+        offset > data->data_len - fixed ||
+        bytes > data->data_len - fixed - offset) return false;
+    target = (const WCHAR *)((const unsigned char *)data->body.symlink.path +
+      offset);
+    len = bytes / sizeof(WCHAR);
+  } else if (tag == IO_REPARSE_TAG_MOUNT_POINT) {
+    const size_t fixed = offsetof(ScrStatsReparseData, body.mount.path) -
+      body_offset;
+    size_t offset = data->body.mount.substitute_offset;
+    size_t bytes = data->body.mount.substitute_len;
+    if (data->data_len < fixed || ((offset | bytes) & 1) != 0 ||
+        offset > data->data_len - fixed ||
+        bytes > data->data_len - fixed - offset) return false;
+    target = (const WCHAR *)((const unsigned char *)data->body.mount.path +
+      offset);
+    len = bytes / sizeof(WCHAR);
+    _Static_assert(sizeof(WCHAR) == sizeof(uint16_t),
+                   "Windows reparse payloads use UTF-16 code units");
+    if (!scr_win_stats_mount_target_is_junction(
+          (const uint16_t *)target, len)) return false;
+  } else if (tag == UINT32_C(0xA000001D)) {
+    /* WSL's LX symlink payload is a version word followed by UTF-8 bytes. */
+    if (data->data_len < sizeof(ULONG)) return false;
+    *size_out = (double)(data->data_len - sizeof(ULONG));
+    return true;
+  } else {
+    /* App execution links carry a counted UTF-16 string list; the third
+     * string is the target path. */
+    if (tag != IO_REPARSE_TAG_APPEXECLINK ||
+        data->data_len < sizeof(ULONG)) return false;
+    const unsigned char *raw = data->body.generic.bytes;
+    ULONG count;
+    memcpy(&count, raw, sizeof count);
+    if (count < 3 || ((data->data_len - sizeof count) & 1) != 0) return false;
+    target = (const WCHAR *)(raw + sizeof count);
+    size_t chars = (data->data_len - sizeof count) / sizeof(WCHAR);
+    for (size_t item = 0; item < 2; item++) {
+      size_t part = 0;
+      while (part < chars && target[part] != L'\0') part++;
+      if (part == 0 || part == chars) return false;
+      target += part + 1;
+      chars -= part + 1;
+    }
+    len = 0;
+    while (len < chars && target[len] != L'\0') len++;
+    if (len == 0 || len == chars || len < 3 ||
+        !((target[0] >= L'A' && target[0] <= L'Z') ||
+          (target[0] >= L'a' && target[0] <= L'z')) ||
+        target[1] != L':' || target[2] != L'\\') return false;
+    double size = scr_stats_utf16_len(target, len);
+    if (size < 0) return false;
+    *size_out = size;
+    return true;
+  }
+
+  /* Undo the NT namespace prefix CreateSymbolicLinkW stores for absolute
+   * DOS/UNC targets, matching libuv's readlink normalization. */
+  if (len >= 4 && target[0] == L'\\' && target[1] == L'?' &&
+      target[2] == L'?' && target[3] == L'\\') {
+    if (len >= 6 && target[5] == L':' &&
+        ((target[4] >= L'A' && target[4] <= L'Z') ||
+         (target[4] >= L'a' && target[4] <= L'z')) &&
+        (len == 6 || target[6] == L'\\')) {
+      target += 4;
+      len -= 4;
+    } else if (len >= 8 &&
+               (target[4] == L'U' || target[4] == L'u') &&
+               (target[5] == L'N' || target[5] == L'n') &&
+               (target[6] == L'C' || target[6] == L'c') &&
+               target[7] == L'\\') {
+      target += 6;
+      len -= 6;
+    }
+  }
+  double size = scr_stats_utf16_len(target, len);
+  if (size < 0) return false;
+  *size_out = size;
+  return true;
+}
+
+static ScrStats *scr_stats_of_path(const ScrStr *path, const char *op,
+                                   bool no_follow) {
+  WCHAR *wide = scr_fs_win_wide(path);
+  if (!wide) return scr_stats_crt_fallback(path, op);
+
+  DWORD flags = FILE_FLAG_BACKUP_SEMANTICS;
+  if (no_follow) flags |= FILE_FLAG_OPEN_REPARSE_POINT;
+  HANDLE h = CreateFileW(wide, FILE_READ_ATTRIBUTES,
+                         FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+                         NULL, OPEN_EXISTING, flags, NULL);
+  free(wide);
+  if (h == INVALID_HANDLE_VALUE) return scr_stats_crt_fallback(path, op);
+
+  DWORD file_type = GetFileType(h);
+  if (file_type != FILE_TYPE_DISK) {
+    CloseHandle(h);
+    return scr_stats_crt_fallback(path, op);
+  }
+  BY_HANDLE_FILE_INFORMATION basic;
+  if (!GetFileInformationByHandle(h, &basic)) {
+    CloseHandle(h);
+    return scr_stats_crt_fallback(path, op);
+  }
+  bool is_link = false;
+  double link_size = -1;
+  if (no_follow && (basic.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT)) {
+    FILE_ATTRIBUTE_TAG_INFO tagged;
+    if (!GetFileInformationByHandleEx(
+          h, FileAttributeTagInfo, &tagged, sizeof tagged) ||
+        !scr_stats_is_link_tag(tagged.ReparseTag)) {
+      /* Reparse points are a general interception mechanism. Node/libuv
+       * follows non-link tags even for lstat, so reopen the resolved target. */
+      CloseHandle(h);
+      return scr_stats_of_path(path, op, false);
+    }
+    if (!scr_stats_link_size(h, tagged.ReparseTag, &link_size)) {
+      /* A mount-point tag may name a mounted volume rather than a junction.
+       * libuv treats those (and malformed/unsupported link payloads) as
+       * ordinary reparse points and retries with the final component
+       * followed. Do not classify from the tag alone. */
+      CloseHandle(h);
+      return scr_stats_of_path(path, op, false);
+    }
+    is_link = true;
+  }
+  FILE_STANDARD_INFO standard;
+  bool have_standard = GetFileInformationByHandleEx(
+    h, FileStandardInfo, &standard, sizeof standard);
+  CloseHandle(h);
+
+  bool is_dir = (basic.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) != 0;
+  uint64_t size = ((uint64_t)basic.nFileSizeHigh << 32) | basic.nFileSizeLow;
+  ScrStats *s = scr_stats_new();
+  s->is_file = !is_link && (have_standard ? !standard.Directory : !is_dir);
+  s->is_dir = !is_link && (have_standard ? standard.Directory : is_dir);
+  s->is_symlink = is_link;
+  s->size = is_link && link_size >= 0 ? link_size : s->is_dir ? 0.0
+    : have_standard ? (double)standard.EndOfFile.QuadPart : (double)size;
+  s->blocks = have_standard
+    ? (double)((uint64_t)standard.AllocationSize.QuadPart >> 9)
+    : size == 0 ? 0.0 : (double)((size + 511) >> 9);
+  s->nlink = have_standard
+    ? (double)standard.NumberOfLinks
+    : (double)basic.nNumberOfLinks;
+  s->atime_ms = scr_filetime_unix_ms(basic.ftLastAccessTime);
+  s->mtime_ms = scr_filetime_unix_ms(basic.ftLastWriteTime);
+  return s;
+}
 #else
+static ScrStats *scr_stats_of(const struct stat *st) {
+  ScrStats *s = scr_stats_new();
+  s->is_file = S_ISREG(st->st_mode);
+  s->is_dir = S_ISDIR(st->st_mode);
   s->is_symlink = S_ISLNK(st->st_mode);
 #if defined(__APPLE__)
+  s->atime_ms = (double)st->st_atimespec.tv_sec * 1000.0 +
+                (double)st->st_atimespec.tv_nsec / 1e6;
   s->mtime_ms = (double)st->st_mtimespec.tv_sec * 1000.0 +
                 (double)st->st_mtimespec.tv_nsec / 1e6;
 #else
+  s->atime_ms = (double)st->st_atim.tv_sec * 1000.0 +
+                (double)st->st_atim.tv_nsec / 1e6;
   s->mtime_ms = (double)st->st_mtim.tv_sec * 1000.0 +
                 (double)st->st_mtim.tv_nsec / 1e6;
 #endif
-#endif
+  s->blocks = (double)st->st_blocks;
+  s->nlink = (double)st->st_nlink;
   s->size = (double)st->st_size;
   return s;
 }
+#endif
 
 ScrStats *scr_fs_stat(ScrStr *path) {
+#ifdef _WIN32
+  return scr_stats_of_path(path, "stat", false);
+#else
   struct stat st;
   if (stat(path->data, &st) != 0) { /* follows symlinks, like Node's statSync */
     scr_fs_throw(errno, "stat", path);
     return NULL;
   }
   return scr_stats_of(&st);
+#endif
 }
 
 ScrStats *scr_fs_lstat(ScrStr *path) {
+#ifdef _WIN32
+  return scr_stats_of_path(path, "lstat", true);
+#else
   struct stat st;
   if (lstat(path->data, &st) != 0) { /* no follow; Node reports lstat */
     scr_fs_throw(errno, "lstat", path);
     return NULL;
   }
   return scr_stats_of(&st);
+#endif
 }
 
 ScrArr *scr_fs_readdir(ScrStr *path) {
@@ -3116,10 +3884,6 @@ ScrStr *scr_crypto_x509_valid_to_str(ScrStr *pem) {
 
 /* ── String surface (fromCharCode / lastIndexOf) ─────────────────────── */
 
-/* Forward declaration — scr_to_uint32 lives with the bitwise operators
- * below (ToUint16 is its low 16 bits, per spec). */
-static uint32_t scr_to_uint32(double d);
-
 /* String.fromCharCode core over n UTF-16 code units read through
  * `unit(src, i)` (already ToUint16'd): combine adjacent surrogate pairs,
  * substitute U+FFFD for lone surrogates (divergence 1's storage policy —
@@ -3214,9 +3978,10 @@ double scr_str_last_index_of(ScrStr *s, ScrStr *needle) {
   return -1.0;
 }
 
-/* ── Date, the composed slice ──────────────────────────────────────────
- * Date values have no representation — the compiled surface is exactly
- * Date.now() and the composed new Date(ms?).toISOString(). */
+/* ── Date, the read-only value slice ───────────────────────────────────
+ * Values are TimeClip'd epoch-millisecond scalars. Identity/mutation are
+ * frontend-fenced; construction, storage, getters, and ISO formatting
+ * observe exactly this payload. */
 
 double scr_date_now(void) {
   struct timespec ts;
@@ -3225,6 +3990,16 @@ double scr_date_now(void) {
   return floor((double)ts.tv_sec * 1000.0 + (double)ts.tv_nsec / 1e6);
 }
 
+/* Date's TimeClip: non-finite/out-of-range values become Invalid Date,
+ * finite values truncate toward zero, and -0 normalizes to +0. */
+double scr_date_new_ms(double ms) {
+  if (!isfinite(ms) || fabs(ms) > 8640000000000000.0) return NAN;
+  double clipped = trunc(ms);
+  return clipped == 0 ? 0 : clipped;
+}
+
+double scr_date_get_time(double ms) { return ms; }
+
 /* Node's Date.prototype.toISOString over a millisecond time value:
  * TimeClip's ToInteger truncation, proleptic Gregorian civil-from-days
  * (Howard Hinnant's algorithm), YYYY-MM-DDTHH:mm:ss.sssZ with expanded
@@ -3291,7 +4066,7 @@ static double scr_days_from_civil(long long y, int m, int d) {
   return (double)(era * 146097 + (long long)doe - 719468);
 }
 
-static double scr_date_ms_of(long long y, int mo, int d, int hh, int mi, int ss, int ms) {
+static double scr_date_make_ms(long long y, int mo, int d, int hh, int mi, int ss, int ms) {
   /* V8 accepts days 1..31 in every month and ROLLS OVER past the month's
    * end (Feb 30 → Mar 2) — days_from_civil extrapolates linearly, so the
    * rollover falls out; day 0 and 32+ are NaN, like V8. */
@@ -3299,10 +4074,13 @@ static double scr_date_ms_of(long long y, int mo, int d, int hh, int mi, int ss,
   if (hh > 24 || mi > 59 || ss > 59 || (hh == 24 && (mi || ss || ms))) return NAN;
   double t = scr_days_from_civil(y, mo, d) * 86400000.0 +
              hh * 3600000.0 + mi * 60000.0 + ss * 1000.0 + ms;
-  if (fabs(t) > 8640000000000000.0) return NAN;
   return t;
 }
 
+static double scr_date_ms_of(long long y, int mo, int d, int hh, int mi, int ss, int ms) {
+  return scr_date_new_ms(scr_date_make_ms(y, mo, d, hh, mi, ss, ms));
+}
+
 static bool scr_date_digits(const char **p, const char *end, int n, int *out) {
   int v = 0;
   if (end - *p < n) return false;
@@ -3358,6 +4136,7 @@ double scr_date_parse_get_time(ScrStr *s) {
       bool neg = *p == '-';
       p++;
       if (!scr_date_digits(&p, end, 6, &y6)) return NAN;
+      if (neg && y6 == 0) return NAN; /* ECMA forbids expanded -000000 */
       yy = neg ? -(long long)y6 : y6;
     } else {
       if (!scr_date_digits(&p, end, 4, &y)) return NAN;
@@ -3393,14 +4172,18 @@ double scr_date_parse_get_time(ScrStr *s) {
       p++;
       if (!scr_date_digits(&p, end, 2, &oh) || p >= end || *p++ != ':') return NAN;
       if (!scr_date_digits(&p, end, 2, &om)) return NAN;
+      if (oh > 23 || om > 59) return NAN;
       off = (oh * 60 + om) * 60000.0;
       if (neg) off = -off;
     } else {
       return NAN;
     }
     if (p != end) return NAN;
-    double t = scr_date_ms_of(yy, mo, d, hh, mi, ss, ms);
-    return isnan(t) ? t : t - off;
+    /* MakeDate can lie just beyond the TimeClip boundary while the
+     * explicit offset brings the final UTC instant back into range. The
+     * spec clips only after that offset has been applied. */
+    double t = scr_date_make_ms(yy, mo, d, hh, mi, ss, ms);
+    return scr_date_new_ms(t - off);
   }
 }
 
@@ -3412,10 +4195,10 @@ double scr_date_parse_get_time(ScrStr *s) {
  * 1900+year (the spec's MakeFullYear), out-of-range months ROLL into the
  * year (Date.UTC(2017, 13) is Feb 2018) and any integer date offsets from
  * day 1 of that month — days_from_civil extrapolates linearly, so both
- * rollovers fall out. V8 bounds MakeDay's year to ±1e6 (kMaxYear/kMinYear,
- * date.h) before TimeClip can see the result, and Node answers NaN past
- * it — matched here, and it keeps days_from_civil's long long exact.
- * Never throws. */
+ * rollovers fall out. V8 bounds MakeDay's input year to ±1e6 and input
+ * month to ±1e7 before normalizing the month (kMaxYear/kMinYear and
+ * kMaxMonth/kMinMonth, date.h); Node answers NaN past either bound even
+ * when the two inputs would normalize back into range. Never throws. */
 double scr_date_utc(double y, double mo, double d,
                     double h, double mi, double s, double ms) {
   if (!isfinite(y) || !isfinite(mo) || !isfinite(d) || !isfinite(h) ||
@@ -3429,16 +4212,150 @@ double scr_date_utc(double y, double mo, double d,
   mi = trunc(mi);
   s = trunc(s);
   ms = trunc(ms);
+  if (fabs(y) > 1000000.0 || fabs(mo) > 10000000.0) return NAN;
   if (y >= 0 && y <= 99) y += 1900;
   double ym = y + floor(mo / 12.0);
   int mn = (int)(mo - floor(mo / 12.0) * 12.0); /* 0..11 */
-  if (fabs(ym) > 1000000.0) return NAN; /* V8's MakeDay year bound */
   double days = scr_days_from_civil((long long)ym, mn + 1, 1) + (d - 1.0);
   double t = days * 86400000.0 + h * 3600000.0 + mi * 60000.0 + s * 1000.0 + ms;
   if (fabs(t) > 8640000000000000.0) return NAN; /* TimeClip */
   return t == 0 ? 0 : t; /* normalize -0 (TimeClip's +0) */
 }
 
+/* ── Date calendar getters ────────────────────────────────────────────
+ * UTC fields use the same proleptic-Gregorian walk as toISOString, so the
+ * whole Date range is portable. Local fields use the host timezone via
+ * localtime, exactly the environment the sibling Node process observes;
+ * a libc that cannot represent an extreme instant answers NaN rather than
+ * inventing a zone. */
+
+typedef struct ScrDateParts {
+  long long year;
+  int month, date, day, hours, minutes, seconds, milliseconds;
+  double timezone_offset;
+} ScrDateParts;
+
+/* Calendar decomposition itself also serves LocalTime(t), which can lie
+ * just outside TimeClip's UTC interval after applying a zone offset at an
+ * endpoint. The checked wrapper is the public UTC-getter gate; the inner
+ * walk accepts those bounded local-time values too. */
+static void scr_date_utc_parts_unchecked(double t, ScrDateParts *out) {
+  double dayd = floor(t / 86400000.0);
+  long long msday = (long long)(t - dayd * 86400000.0);
+  long long z = (long long)dayd + 719468;
+  long long era = (z >= 0 ? z : z - 146096) / 146097;
+  unsigned long long doe = (unsigned long long)(z - era * 146097);
+  unsigned long long yoe = (doe - doe / 1460 + doe / 36524 - doe / 146096) / 365;
+  long long y = (long long)yoe + era * 400;
+  unsigned long long doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
+  unsigned long long mp = (5 * doy + 2) / 153;
+  unsigned long long d = doy - (153 * mp + 2) / 5 + 1;
+  unsigned long long m = mp < 10 ? mp + 3 : mp - 9;
+  if (m <= 2) y++;
+  long long wday = ((long long)dayd + 4) % 7;
+  if (wday < 0) wday += 7;
+  out->year = y;
+  out->month = (int)m - 1;
+  out->date = (int)d;
+  out->day = (int)wday;
+  out->hours = (int)(msday / 3600000);
+  out->minutes = (int)(msday / 60000 % 60);
+  out->seconds = (int)(msday / 1000 % 60);
+  out->milliseconds = (int)(msday % 1000);
+  out->timezone_offset = 0;
+}
+
+static bool scr_date_utc_parts(double ms, ScrDateParts *out) {
+  if (!isfinite(ms) || fabs(ms) > 8640000000000000.0) return false;
+  scr_date_utc_parts_unchecked(trunc(ms), out);
+  return true;
+}
+
+static bool scr_date_localtime(double secd, struct tm *out) {
+  time_t sec = (time_t)secd;
+  if ((double)sec != secd) return false;
+#ifdef _WIN32
+  return localtime_s(out, &sec) == 0;
+#else
+  return localtime_r(&sec, out) != NULL;
+#endif
+}
+
+static bool scr_date_local_parts(double ms, ScrDateParts *out) {
+  if (!isfinite(ms) || fabs(ms) > 8640000000000000.0) return false;
+  double clipped = trunc(ms);
+  double secd = floor(clipped / 1000.0);
+  struct tm tmv;
+  double basis_secd = secd;
+  if (!scr_date_localtime(basis_secd, &tmv)) {
+    /* Windows' _localtime64_s rejects pre-epoch instants and years after
+     * 3001 even though both are valid ECMAScript Dates. Query the host's
+     * zone rule at a calendar-equivalent surrogate year in 2000..2399:
+     * Gregorian weekdays/leap years repeat every 400 years. This keeps
+     * every valid Date finite; the OS-vs-Node historical-rule difference
+     * remains the documented timezone-data divergence. */
+    ScrDateParts utc;
+    scr_date_utc_parts_unchecked(clipped, &utc);
+    long long cycle_year = (utc.year - 2000) % 400;
+    if (cycle_year < 0) cycle_year += 400;
+    long long surrogate_year = 2000 + cycle_year;
+    basis_secd =
+      scr_days_from_civil(surrogate_year, utc.month + 1, utc.date) * 86400.0 +
+      utc.hours * 3600.0 + utc.minutes * 60.0 + utc.seconds;
+    if (!scr_date_localtime(basis_secd, &tmv)) return false;
+  }
+  /* Treat the local broken-down fields as UTC. Its distance from the real
+   * (or surrogate) epoch second is the zone offset. Apply that offset to
+   * the original instant and use the portable Gregorian walk for its
+   * fields; Date#getTimezoneOffset uses the
+   * opposite sign (UTC - local), in whole minutes. Historical local-mean
+   * offsets can contain seconds, which JavaScript truncates toward zero. */
+  double local_as_utc =
+    scr_days_from_civil((long long)tmv.tm_year + 1900, tmv.tm_mon + 1, tmv.tm_mday) * 86400.0 +
+    tmv.tm_hour * 3600.0 + tmv.tm_min * 60.0 + tmv.tm_sec;
+  double local_offset = local_as_utc - basis_secd;
+  scr_date_utc_parts_unchecked(clipped + local_offset * 1000.0, out);
+  double timezone_offset = trunc(-local_offset / 60.0);
+  out->timezone_offset = timezone_offset == 0 ? 0 : timezone_offset;
+  return true;
+}
+
+static bool scr_date_parts(double ms, bool utc, ScrDateParts *out) {
+  return utc ? scr_date_utc_parts(ms, out) : scr_date_local_parts(ms, out);
+}
+
+#define SCR_DATE_PART_GETTER(name, field)                                    \
+  double scr_date_get_##name(double ms, bool utc) {                          \
+    ScrDateParts p;                                                           \
+    return scr_date_parts(ms, utc, &p) ? (double)p.field : NAN;              \
+  }                                                                           \
+  double scr_date_get_##name##_local(double ms) {                            \
+    return scr_date_get_##name(ms, false);                                    \
+  }                                                                           \
+  double scr_date_get_##name##_utc(double ms) {                              \
+    return scr_date_get_##name(ms, true);                                     \
+  }
+
+SCR_DATE_PART_GETTER(full_year, year)
+SCR_DATE_PART_GETTER(month, month)
+SCR_DATE_PART_GETTER(date, date)
+SCR_DATE_PART_GETTER(day, day)
+SCR_DATE_PART_GETTER(hours, hours)
+SCR_DATE_PART_GETTER(minutes, minutes)
+SCR_DATE_PART_GETTER(seconds, seconds)
+
+#undef SCR_DATE_PART_GETTER
+
+double scr_date_get_milliseconds(double ms) {
+  ScrDateParts p;
+  return scr_date_utc_parts(ms, &p) ? (double)p.milliseconds : NAN;
+}
+
+double scr_date_get_timezone_offset(double ms) {
+  ScrDateParts p;
+  return scr_date_local_parts(ms, &p) ? p.timezone_offset : NAN;
+}
+
 /* ── Number statics ────────────────────────────────────────────────────
  * JS-exact: the ES2015 Number statics never coerce (unlike the global
  * isNaN/isFinite), and the compiler routes only number-typed arguments
@@ -3780,14 +4697,6 @@ bool scr_num_is_safe_integer(double x) {
  * narrowing casts, no UB shifts of signed values).
  */
 
-static uint32_t scr_to_uint32(double d) {
-  if (!isfinite(d)) return 0; /* NaN, +Infinity, -Infinity */
-  double t = trunc(d);
-  t = fmod(t, 4294967296.0); /* exact for doubles; result in (-2^32, 2^32) */
-  if (t < 0) t += 4294967296.0;
-  return (uint32_t)t;
-}
-
 /* The 32 bits as a SIGNED (Int32) JS number. */
 static double scr_bits_as_int32(uint32_t u) {
   return u >= UINT32_C(0x80000000)