@scriptc/runtime 0.0.8 → 0.0.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scriptc/runtime",
-  "version": "0.0.8",
+  "version": "0.0.9",
   "description": "scriptc native runtime — C sources, compiled into every scriptc binary",
   "license": "Apache-2.0",
   "homepage": "https://scriptc.dev",

package/src/scr_bytes.c

@@ -312,6 +312,49 @@ double scr_dataview_get(const ScrBytes *b, double byte_off, ScrDataViewGet kind,
   return 0; /* unreachable */
 }
 
+void scr_dataview_set(ScrBytes *b, double byte_off, double value, ScrDataViewGet kind, bool le) {
+  size_t width = scr_dataview_get_size(kind);
+  /* ToIndex + the view-relative bounds check — the getters' ONE message. */
+  double off = (byte_off != byte_off) ? 0 : trunc(byte_off);
+  if (!(off >= 0) || off > 9007199254740991.0 || off + (double)width > (double)b->len) {
+    static const char msg[] = "Offset is outside the bounds of the DataView";
+    scr_throw_error_msg(SCR_ERR_RANGE, msg, sizeof msg - 1);
+    return;
+  }
+  /* Coerce to the stored bit pattern. The integer kinds share ToUint32's
+   * 2^32 residue (signed/unsigned store the same bits; narrower widths
+   * take the low bytes — 2^width divides 2^32, so the residues agree);
+   * F32 rounds double→float to nearest even, exactly the spec. */
+  uint64_t u = 0;
+  switch (kind) {
+    case SCR_DV_U8:
+    case SCR_DV_I8:
+    case SCR_DV_U16:
+    case SCR_DV_I16:
+    case SCR_DV_U32:
+    case SCR_DV_I32:
+      u = (uint64_t)scr_bytes_to_u32(value);
+      break;
+    case SCR_DV_F32: {
+      float f = (float)value;
+      uint32_t bits;
+      memcpy(&bits, &f, 4);
+      u = bits;
+      break;
+    }
+    case SCR_DV_F64:
+      memcpy(&u, &value, 8);
+      break;
+    default:
+      return; /* BIG kinds never lower (bigint arguments) */
+  }
+  /* Scatter host-independently; le false is the JS big-endian default. */
+  uint8_t *p = b->data + (size_t)off;
+  for (size_t i = 0; i < width; i++) {
+    p[le ? i : width - 1 - i] = (uint8_t)(u >> (8 * i));
+  }
+}
+
 /* ── encodings (u8 only — the compiler routes only u8 receivers here) ──── */
 
 static const char scr_hex_digits[] = "0123456789abcdef";
@@ -886,16 +929,19 @@ ScrBytes *scr_bytes_from_arr(ScrBytesElem elem, const ScrArr *arr) {
 
 static size_t scr_bytes_received(double v, char out[48]); /* the numeric section below */
 
-/* validateOffset(name, 0, max): non-integers are 'an integer', the rest
- * '>= 0 && <= max' (Node spells '&&' here, unlike the read/write
- * families' 'and'). max < 0 means copy's no-upper-bound '>= 0' render. */
-static bool scr_bytes_validate_off(const char *name, double value, double max) {
-  if (floor(value) == value && value >= 0 && (max < 0 || value <= max)) return true;
+/* validateOffset(name, 0, max): non-integers are 'an integer' (Number.
+ * isInteger — ±Infinity render 'an integer' too), the rest '>= 0 && <=
+ * max' (Node spells '&&' here, unlike the read/write families' 'and').
+ * max < 0 means copy's no-upper-bound '>= 0' render. Exported: the
+ * checked-dynamic compare/equals validators (scr_bytes_io.c) run the
+ * same ladder after their own type gate. */
+bool scr_bytes_validate_off(const char *name, double value, double max) {
+  if (isfinite(value) && floor(value) == value && value >= 0 && (max < 0 || value <= max)) return true;
   char recv[48];
   scr_bytes_received(value, recv);
   char msg[160];
   int mlen;
-  if (floor(value) != value) {
+  if (floor(value) != value || !isfinite(value)) {
     mlen = snprintf(msg, sizeof msg,
                     "The value of \"%s\" is out of range. It must be an integer. Received %s",
                     name, recv);
@@ -909,7 +955,7 @@ static bool scr_bytes_validate_off(const char *name, double value, double max) {
                     "The value of \"%s\" is out of range. It must be >= 0 && <= %s. Received %s",
                     name, maxb, recv);
   }
-  scr_throw_error_msg(SCR_ERR_RANGE, msg, (size_t)mlen);
+  scr_throw_error_msg_code(SCR_ERR_RANGE, msg, (size_t)mlen, "ERR_OUT_OF_RANGE");
   return false;
 }
 
@@ -994,7 +1040,7 @@ static ScrBytes *scr_bytes_fill_core(ScrBytes *b, const uint8_t *pat, size_t pat
                                      bool zero_ok, double nargs, double offset, double end) {
   if (patn == 0 && !zero_ok) {
     static const char msg[] = "The argument 'value' is invalid. Received <Buffer >";
-    scr_throw_error_msg(SCR_ERR_TYPE, msg, sizeof msg - 1);
+    scr_throw_error_msg_code(SCR_ERR_TYPE, msg, sizeof msg - 1, "ERR_INVALID_ARG_VALUE");
     return NULL;
   }
   size_t n = (size_t)nargs;
@@ -1065,7 +1111,7 @@ ScrBytes *scr_bytes_swap(ScrBytes *b, double width) {
   if (b->len % w != 0) {
     char msg[64];
     int mlen = snprintf(msg, sizeof msg, "Buffer size must be a multiple of %zu-bits", w * 8);
-    scr_throw_error_msg(SCR_ERR_RANGE, msg, (size_t)mlen);
+    scr_throw_error_msg_code(SCR_ERR_RANGE, msg, (size_t)mlen, "ERR_INVALID_BUFFER_SIZE");
     return NULL;
   }
   for (size_t g = 0; g < b->len; g += w) {
@@ -1244,7 +1290,7 @@ static void scr_bytes_bounds_error(double value, double length, const char *type
                     type ? type : "offset", recv);
   } else if (length < 0) {
     static const char oob[] = "Attempt to access memory outside buffer bounds";
-    scr_throw_error_msg(SCR_ERR_RANGE, oob, sizeof oob - 1);
+    scr_throw_error_msg_code(SCR_ERR_RANGE, oob, sizeof oob - 1, "ERR_BUFFER_OUT_OF_BOUNDS");
     return;
   } else {
     char lenbuf[32];
@@ -1253,7 +1299,7 @@ static void scr_bytes_bounds_error(double value, double length, const char *type
                     "The value of \"%s\" is out of range. It must be >= %d and <= %s. Received %s",
                     type ? type : "offset", type ? 1 : 0, lenbuf, recv);
   }
-  scr_throw_error_msg(SCR_ERR_RANGE, msg, (size_t)mlen);
+  scr_throw_error_msg_code(SCR_ERR_RANGE, msg, (size_t)mlen, "ERR_OUT_OF_RANGE");
 }
 
 /* The shared offset gate: width bytes at offset must lie inside b. */
@@ -1297,7 +1343,7 @@ static bool scr_bytes_check_int(const ScrBytes *b, double value, double offset,
                       "The value of \"value\" is out of range. It must be >= %s and <= %s. Received %s",
                       minb, maxb, recv);
     }
-    scr_throw_error_msg(SCR_ERR_RANGE, msg, (size_t)mlen);
+    scr_throw_error_msg_code(SCR_ERR_RANGE, msg, (size_t)mlen, "ERR_OUT_OF_RANGE");
     return false;
   }
   return scr_bytes_rw_check(b, offset, width);

package/src/scr_bytes_io.c

@@ -7,9 +7,11 @@
 #include "scr_runtime.h"
 
 #include <errno.h>
+#include <math.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <time.h>
 
 static void scr_bytes_io_oom(void) {
   scr_trap("scriptc: out of memory\n");
@@ -138,7 +140,7 @@ ScrBytes *scr_crypto_random_bytes(double n) {
         msg, sizeof msg,
         "The value of \"size\" is out of range. It must be >= 0 && <= 2147483647. Received %.*s",
         (int)numlen, num);
-    scr_throw_error_msg(SCR_ERR_RANGE, msg, (size_t)mlen);
+    scr_throw_error_msg_code(SCR_ERR_RANGE, msg, (size_t)mlen, "ERR_OUT_OF_RANGE");
     return NULL;
   }
   ScrBytes *b = scr_bytes_new(SCR_BYTES_U8, n);
@@ -158,3 +160,97 @@ bool scr_process_stderr_write_bytes(const ScrBytes *b) {
   fwrite(b->data, 1, b->len * scr_bytes_elem_size(b->elem), stderr);
   return true;
 }
+
+/* ── the checked-dynamic Buffer compare/equals validators ──────────────
+ * Node's argument ladders for buf.equals / buf.compare / Buffer.compare
+ * over DOM-boxed arguments (the invalid-input probes: string needles,
+ * '0' offsets, null/object range args). A well-typed dyn still computes
+ * the real answer — validation, not a constant fence. */
+
+/* A bytes payload or the API's own ERR_INVALID_ARG_TYPE (borrowed). */
+static ScrBytes *scr_bytes_chk_u8(const ScrDyn *d, const char *argname) {
+  if (d->kind != SCR_DYN_BYTES) {
+    scr_dyn_arg_type_fail(argname, "an instance of Buffer or Uint8Array", d);
+    return NULL;
+  }
+  return d->v.bytes;
+}
+
+double scr_buffer_compare_chk(const ScrDyn *a, const ScrDyn *b) {
+  ScrBytes *b1 = scr_bytes_chk_u8(a, "buf1");
+  if (!b1) return 0;
+  ScrBytes *b2 = scr_bytes_chk_u8(b, "buf2");
+  if (!b2) return 0;
+  return scr_bytes_compare(b1, b2, 0, 0, 0, 0, 0);
+}
+
+bool scr_bytes_equals_chk(const ScrBytes *recv, const ScrDyn *other) {
+  ScrBytes *o = scr_bytes_chk_u8(other, "otherBuffer");
+  if (!o) return false;
+  return scr_bytes_equals(recv, o);
+}
+
+/* One offset slot: undefined takes the Node default, non-numbers throw
+ * ERR_INVALID_ARG_TYPE "of type number", numbers run validateOffset. */
+static bool scr_bytes_chk_off(const ScrDyn *d, const char *name, double max,
+                              double dflt, double *out) {
+  if (d->kind == SCR_DYN_UNDEF) {
+    *out = dflt;
+    return true;
+  }
+  if (d->kind != SCR_DYN_NUM) {
+    scr_dyn_arg_type_fail(name, "of type number", d);
+    return false;
+  }
+  *out = d->v.num;
+  return scr_bytes_validate_off(name, *out, max);
+}
+
+double scr_bytes_compare_chk(const ScrBytes *src, const ScrDyn *target,
+                             const ScrDyn *ts, const ScrDyn *te,
+                             const ScrDyn *ss, const ScrDyn *se) {
+  ScrBytes *t = scr_bytes_chk_u8(target, "target");
+  if (!t) return 0;
+  double tsv, tev, ssv, sev;
+  if (!scr_bytes_chk_off(ts, "targetStart", 9007199254740991.0, 0, &tsv)) return 0;
+  if (!scr_bytes_chk_off(te, "targetEnd", (double)t->len, (double)t->len, &tev)) return 0;
+  if (!scr_bytes_chk_off(ss, "sourceStart", 9007199254740991.0, 0, &ssv)) return 0;
+  if (!scr_bytes_chk_off(se, "sourceEnd", (double)src->len, (double)src->len, &sev)) return 0;
+  /* Every slot validated or defaulted above; nargs 4 revalidates the
+   * now-known-good numbers (a no-op) and keeps one comparison core. */
+  return scr_bytes_compare(src, t, 4, tsv, tev, ssv, sev);
+}
+
+/* new Buffer(number, encoding) — the deprecated ctor's string arm with a
+ * non-string first argument: Node's exact ERR_INVALID_ARG_TYPE (the
+ * throwing path never fires DEP0005, so compiled silence matches). */
+ScrBytes *scr_buffer_new_string_fail(const ScrDyn *got) {
+  scr_dyn_arg_type_fail("string", "of type string", got);
+  return NULL;
+}
+
+/* fs._toUnixTimestamp — the seconds coercion the utimes family runs on
+ * its time arguments (fs.js's toUnixTimestamp, underscore-exported):
+ * numeric STRINGS pass ToNumber's loose-equality gate (+time == time —
+ * whitespace-only strings answer 0), finite numbers pass (negatives
+ * answer now/1000, Node's "past times" shape), everything else throws
+ * Node's exact ERR_INVALID_ARG_TYPE. Borrowed; the throw is pending on
+ * the dummy 0 return. */
+double scr_fs_to_unix_timestamp(const ScrDyn *t) {
+  if (t->kind == SCR_DYN_STR) {
+    double n = scr_string_to_number(t->v.str);
+    /* +time == time: NaN fails; every parsed number loosely equals its
+     * own source string by construction of ToNumber. */
+    if (n == n) return n;
+  }
+  if (t->kind == SCR_DYN_NUM && isfinite(t->v.num)) {
+    if (t->v.num < 0) {
+      struct timespec ts;
+      clock_gettime(CLOCK_REALTIME, &ts);
+      return ((double)ts.tv_sec * 1000.0 + (double)ts.tv_nsec / 1e6) / 1000.0;
+    }
+    return t->v.num;
+  }
+  scr_dyn_arg_type_fail("time", "an instance of Date or an Time in seconds", t);
+  return 0;
+}

package/src/scr_dyn_handle.c

@@ -1,77 +1,19 @@
 /* The checked-dynamic HANDLE support unit — everything the handle
  * dispatchers (scr_http.c / scr_net.c) and the emitter unit's dyn
- * registrations share BEYOND the DOM core: errors.js's
- * determineSpecificType renderer and the ERR_INVALID_ARG_TYPE throwers
- * (the listener gate), and the runtime-built listener adapter closures
- * whose fire thunks box event tuples back into the DOM. Split out of
- * scr_json.c so handle-free binaries keep their exact size class:
- * cc.ts compiles this unit exactly when a user of it links (the net or
- * emitter gate — http implies net).
+ * registrations share BEYOND the DOM core: the listener gate over the
+ * ERR_INVALID_ARG_TYPE throwers (the throwers themselves live in
+ * scr_json.c beside the DOM core — the always-linked bytes/fs argument
+ * validators call them too), and the runtime-built listener adapter
+ * closures whose fire thunks box event tuples back into the DOM. Split
+ * out of scr_json.c so handle-free binaries keep their exact size
+ * class: cc.ts compiles this unit exactly when a user of it links (the
+ * net or emitter gate — http implies net).
  */
 #include "scr_runtime.h"
 
 #include <stdio.h>
 #include <string.h>
 
-/* errors.js's determineSpecificType over a DOM value — the "Received
- * ..." tail of Node's ERR_INVALID_ARG_TYPE messages. Renders into buf
- * when the shape needs a payload; returns the text either way. */
-const char *scr_dyn_specific_type(const ScrDyn *cb, char *detail, size_t cap) {
-  const char *d = detail;
-  switch (cb->kind) {
-  case SCR_DYN_NULL: d = "null"; break;
-  case SCR_DYN_UNDEF: d = "undefined"; break;
-  case SCR_DYN_OBJ: d = "an instance of Object"; break;
-  case SCR_DYN_ARR: d = "an instance of Array"; break;
-  case SCR_DYN_BYTES: d = "an instance of Uint8Array"; break;
-  case SCR_DYN_FUNC: d = "function"; break; /* callers usually return before this */
-  case SCR_DYN_HANDLE:
-    snprintf(detail, cap, "an instance of %s", scr_dyn_handle_cls(cb));
-    break;
-  case SCR_DYN_PROMISE: d = "an instance of Promise"; break;
-  case SCR_DYN_BOOL:
-    snprintf(detail, cap, "type boolean (%s)", cb->v.b ? "true" : "false");
-    break;
-  case SCR_DYN_NUM: {
-    char num[32];
-    size_t n = scr_f64_to_str(cb->v.num, num);
-    snprintf(detail, cap, "type number (%.*s)", (int)n, num);
-    break;
-  }
-  case SCR_DYN_STR: {
-    const ScrStr *sv = cb->v.str;
-    char insp[32];
-    size_t n = 0;
-    insp[n++] = '\'';
-    for (size_t i = 0; i < sv->len && n < 28; i++) insp[n++] = sv->data[i];
-    if (sv->len + 2 > 28) {
-      n = 25;
-      memcpy(insp + n, "...", 3);
-      n += 3;
-    } else {
-      insp[n++] = '\'';
-    }
-    snprintf(detail, cap, "type string (%.*s)", (int)n, insp);
-    break;
-  }
-  default: d = "an instance of Object"; break;
-  }
-  return d;
-}
-
-/* Node's ERR_INVALID_ARG_TYPE thrower ("The \"chunk\" argument must be
- * of type string or an instance of Buffer or Uint8Array. Received type
- * number (5)") — the handle dispatchers' per-arg gates. `expected` is
- * the full "of type ..."/"an instance of ..." clause. */
-void scr_dyn_arg_type_fail(const char *argname, const char *expected, const ScrDyn *got) {
-  char detail[64];
-  const char *d = scr_dyn_specific_type(got, detail, sizeof detail);
-  char msg[224];
-  int len = snprintf(msg, sizeof msg,
-                     "The \"%s\" argument must be %s. Received %s", argname, expected, d);
-  scr_throw_error_msg_code(SCR_ERR_TYPE, msg, (size_t)len, "ERR_INVALID_ARG_TYPE");
-}
-
 /* Node's ERR_INVALID_ARG_TYPE listener gate (errors.js's
  * determineSpecificType shapes — the scr_emitter_check_listener wording,
  * shared here so the gated units need not link the emitter unit). */

package/src/scr_error.c

@@ -237,6 +237,21 @@ void scr_throw_error_msg_code(int kind, const char *message, size_t len,
                  scr_error_traced ? &scr_error_trace : NULL);
 }
 
+/* A compiler-resolved Node-parity throw (the always-throwing lowered
+ * arms: ERR_INVALID_THIS receivers, ERR_MISSING_ARGS ladders, the
+ * symbol-to-string TypeError): builds the builtin error of `kind` with
+ * `code` stamped when non-empty. Borrows both strings; always throws
+ * (catchably — call sites are compiler-emitted pending checks). */
+void scr_throw_node_coded(double kind, const ScrStr *code, const ScrStr *msg) {
+  ScrError *e = scr_error_new((int)kind, (ScrStr *)msg); /* borrowed in */
+  if (code->len > 0) {
+    scr_str_release(e->code); /* NULL-safe */
+    e->code = scr_str_retain((ScrStr *)code);
+  }
+  scr_throw_obj(e, &scr_error_retain_v, &scr_error_release_v,
+                 scr_error_traced ? &scr_error_trace : NULL);
+}
+
 /* A read of a `declare`d const nothing defines (the bundler-define
  * pattern — __VERSION__): Node running the source throws ReferenceError
  * "<name> is not defined" at the access. Borrows `name`; always throws

package/src/scr_events_emitter.c

@@ -662,6 +662,18 @@ ScrArr *scr_emitter_listeners(ScrEmitter *em, ScrStr *name) {
 
 /* ── max listeners ────────────────────────────────────────────────────── */
 
+/* The checked-dynamic setMaxListeners ladder: non-numbers throw Node's
+ * ERR_INVALID_ARG_TYPE ("The \"setMaxListeners\" argument must be of
+ * type number. Received ..."), numbers run the range gate below.
+ * Borrowed dyn; +1 receiver either way (the pending check unwinds). */
+ScrEmitter *scr_emitter_set_max_chk(ScrEmitter *em, const ScrDyn *n) {
+  if (n->kind != SCR_DYN_NUM) {
+    scr_dyn_arg_type_fail("setMaxListeners", "of type number", n);
+    return scr_emitter_retain(em);
+  }
+  return scr_emitter_set_max(em, n->v.num);
+}
+
 ScrEmitter *scr_emitter_set_max(ScrEmitter *em, double n) {
   if (!(n >= 0)) { /* negatives and NaN — Node's validateNumber */
     char num[32];
@@ -682,6 +694,28 @@ double scr_emitter_get_max(ScrEmitter *em) {
   return scr_emitter_default_max;
 }
 
+/* The checked-dynamic defaultMaxListeners ladder — `name` picks the
+ * message's slot ("setMaxListeners" for the static call,
+ * "defaultMaxListeners" for the module-property assignment, Node's own
+ * split). Borrowed. */
+void scr_emitter_set_default_max_chk(const ScrDyn *n, const ScrStr *name) {
+  if (n->kind != SCR_DYN_NUM) {
+    scr_dyn_arg_type_fail(name->data, "of type number", n);
+    return;
+  }
+  if (!(n->v.num >= 0)) {
+    char num[32];
+    size_t nlen = scr_f64_to_str(n->v.num, num);
+    char msg[128];
+    int len = snprintf(msg, sizeof msg,
+                       "The value of \"%s\" is out of range. It must be >= 0. Received %.*s",
+                       name->data, (int)nlen, num);
+    scr_throw_error_msg_code(SCR_ERR_RANGE, msg, (size_t)len, "ERR_OUT_OF_RANGE");
+    return;
+  }
+  scr_emitter_set_default_max(n->v.num);
+}
+
 void scr_emitter_set_default_max(double n) {
   if (!(n >= 0)) { /* negatives and NaN — Node's validateNumber(n, "setMaxListeners", 0) */
     char num[32];

package/src/scr_exception.c

@@ -181,7 +181,10 @@ ScrStr *scr_caught_to_string(const ScrCaught *c) {
  * contract-shaped failure exactly like a trap. Render the same "Uncaught
  * ..." first line the executable epilogue prints (scr_exc_print_uncaught's
  * arms, buffer-writing), release the payload, and route the text through
- * the trap funnel — one failure channel at the boundary. */
+ * the trap funnel — one failure channel at the boundary. The funnel
+ * (scr_library.c) assembles the rendered line into the structured
+ * trap-teaching form (code SC4013, the trapping entry's symbol) before
+ * delivery; only the 0x01-led verbatim path below bypasses assembly. */
 void scr_library_check_exc(void) {
   if (!scr_exc_pending()) return;
   static char buf[1024]; /* the message is copied out before the payload dies */

package/src/scr_island.c

@@ -379,6 +379,7 @@ enum {
   ISL_H_DESTRCHECK,
   ISL_H_ITERN,
   ISL_H_ITER,
+  ISL_H_CALLSPREAD,
   ISL_H_COUNT,
 };
 
@@ -417,7 +418,17 @@ static const char isl_prelude[] =
     "else if(typeof v===\"number\")d=\"number \"+v;else if(typeof v===\"boolean\")d=\"boolean \"+v;"
     "else if(typeof v===\"function\")d=\"function\";else d=\"object\";"
     "throw new TypeError(d+\" is not iterable (cannot read property Symbol(Symbol.iterator))\")}"
-    "return v[Symbol.iterator]()}]";
+    "return v[Symbol.iterator]()},"
+    /* ISL_H_CALLSPREAD: spread application (`f(...pre, ...s)` — the
+     * rest-forwarding idiom's call): REAL spread syntax, so iterator
+     * protocols are the engine's own; the guards front-run V8's exact
+     * spread-call TypeError texts (nullish spells the spread expression
+     * `w`, everything else the generic Spread-syntax text). */
+    "(f,p,s,w)=>{if(s===undefined||s===null)"
+    "throw new TypeError(w+\" is not iterable (cannot read property \"+s+\")\");"
+    "if(typeof s[Symbol.iterator]!==\"function\")"
+    "throw new TypeError(\"Spread syntax requires ...iterable[Symbol.iterator] to be a function\");"
+    "return f(...p,...s)}]";
 
 static void isl_free_boot(void);
 static void isl_prom_wraps_teardown(void);
@@ -1274,6 +1285,23 @@ ScrJsval *scr_jsval_call(ScrJsval *f, int argc, ScrJsval **argv) {
   return isl_cell_new(r);
 }
 
+/* Spread application on an island callee (jsOp callSpread) — the prelude
+ * helper's real `f(...pre, ...spread)`, so iterator protocols are the
+ * engine's own and the guards front-run V8's exact spread-call TypeError
+ * texts (`what` is the spread expression's source spelling). Borrows
+ * everything; +1 out, or NULL with the engine exception bridged. */
+ScrJsval *scr_jsval_call_spread(ScrJsval *f, ScrJsval *pre, ScrJsval *spread, const ScrStr *what) {
+  isl_entry();
+  JSValue argv[4] = {f->v, pre->v, spread->v, JS_NewStringLen(isl_ctx, what->data, what->len)};
+  JSValue r = JS_Call(isl_ctx, isl_helpers[ISL_H_CALLSPREAD], JS_UNDEFINED, 4, argv);
+  JS_FreeValue(isl_ctx, argv[3]);
+  if (JS_IsException(r)) {
+    isl_bridge_exception();
+    return NULL;
+  }
+  return isl_cell_new(r);
+}
+
 /* `new X(...)` on an island callee (jsOp construct). Borrows everything;
  * +1 out, or NULL with the engine exception bridged. */
 ScrJsval *scr_jsval_construct(ScrJsval *f, int argc, ScrJsval **argv) {

package/src/scr_json.c

@@ -424,6 +424,52 @@ void scr_dyn_arr_push(ScrDyn *arr, ScrDyn *item) {
   arr->v.arr.items[arr->v.arr.len++] = item; /* ownership moves in */
 }
 
+/* Spread completion for a runtime-arity argument list (`f(...xs)` in the
+ * checked-dynamic tier): JS's spread over the DOM's iterable kinds —
+ * arrays element-by-element (retained), strings by code POINT (the string
+ * iterator; astral chars arrive unsplit), bytes by byte; every other kind
+ * throws V8's exact SPREAD-CALL TypeError (catchable, pending — callers
+ * check): nullish sources spell the spread expression (`what`) — "v is
+ * not iterable (cannot read property undefined)" — and everything else is
+ * the generic "Spread syntax requires ...iterable[Symbol.iterator] to be
+ * a function". Borrows src. */
+void scr_dyn_arr_push_spread(ScrDyn *arr, const ScrDyn *src, const char *what) {
+  if (src->kind == SCR_DYN_ARR) {
+    for (size_t i = 0; i < src->v.arr.len; i++) {
+      scr_dyn_arr_push(arr, scr_dyn_retain(src->v.arr.items[i]));
+    }
+    return;
+  }
+  if (src->kind == SCR_DYN_BYTES) {
+    for (size_t i = 0; i < src->v.bytes->len; i++) {
+      scr_dyn_arr_push(arr, scr_dyn_new_num((double)src->v.bytes->data[i]));
+    }
+    return;
+  }
+  if (src->kind == SCR_DYN_STR) {
+    double len = scr_str_utf16_len(src->v.str);
+    for (double at = 0; at < len;) {
+      ScrStr *cp = scr_str_cp_at(src->v.str, at);
+      at += scr_str_utf16_len(cp);
+      scr_dyn_arr_push(arr, scr_dyn_new_str(cp));
+      scr_str_release(cp);
+    }
+    return;
+  }
+  if (src->kind == SCR_DYN_UNDEF || src->kind == SCR_DYN_NULL) {
+    ScrJsonBuf b;
+    scr_jb_init(&b);
+    scr_jb_puts(&b, what);
+    scr_jb_puts(&b, " is not iterable (cannot read property ");
+    scr_jb_puts(&b, src->kind == SCR_DYN_UNDEF ? "undefined" : "null");
+    scr_jb_puts(&b, ")");
+    scr_throw_error(SCR_ERR_TYPE, scr_jb_finish(&b));
+    return;
+  }
+  static const char msg[] = "Spread syntax requires ...iterable[Symbol.iterator] to be a function";
+  scr_throw_error_msg(SCR_ERR_TYPE, msg, sizeof msg - 1);
+}
+
 /* Takes ownership of key (malloc'd) and value. Duplicate keys: the LATER
  * value wins (like JS JSON.parse) — the old value is released and the new
  * key buffer freed (the surviving entry keeps its original, equal key). */
@@ -551,6 +597,13 @@ ScrDyn *scr_dyn_call(const ScrDyn *d, ScrDyn *const *args, size_t argc, const ch
   return d->v.fn.thunk(d->v.fn.clo, args, argc);
 }
 
+/* scr_dyn_call over a DOM ARRAY's elements — the spread-application form
+ * (`f(...args)` after the emitted argument array is built). Borrows both;
+ * result owned (+1), or NULL with the exception pending. */
+ScrDyn *scr_dyn_apply(const ScrDyn *d, const ScrDyn *args, const char *what) {
+  return scr_dyn_call(d, args->v.arr.items, args->v.arr.len, what);
+}
+
 /* ── native handles in the DOM (SCR_DYN_HANDLE) ───────────────────────
  * Per-tag ops stamped by the owning units at main() (scr_http_dyn_install
  * / scr_net_dyn_install — the scr_net_install hook story), so this
@@ -582,6 +635,76 @@ const ScrDynHandleOps *scr_dyn_handle_ops_of(const ScrDyn *d) {
   return scr_dyn_handle_ops(d->v.handle.tag);
 }
 
+/* errors.js's determineSpecificType over a DOM value — the "Received
+ * ..." tail of Node's ERR_INVALID_ARG_TYPE messages. Renders into buf
+ * when the shape needs a payload; returns the text either way. Lives
+ * beside the DOM core (not the gated handle unit) because the always-
+ * linked argument validators (bytes, fs) render through it too. */
+const char *scr_dyn_specific_type(const ScrDyn *cb, char *detail, size_t cap) {
+  const char *d = detail;
+  switch (cb->kind) {
+  case SCR_DYN_NULL: d = "null"; break;
+  case SCR_DYN_UNDEF: d = "undefined"; break;
+  case SCR_DYN_OBJ: d = "an instance of Object"; break;
+  case SCR_DYN_ARR: d = "an instance of Array"; break;
+  case SCR_DYN_BYTES: d = "an instance of Uint8Array"; break;
+  case SCR_DYN_FUNC: d = "function"; break; /* callers usually return before this */
+  case SCR_DYN_HANDLE:
+    snprintf(detail, cap, "an instance of %s", scr_dyn_handle_cls(cb));
+    break;
+  case SCR_DYN_PROMISE: d = "an instance of Promise"; break;
+  case SCR_DYN_BOOL:
+    snprintf(detail, cap, "type boolean (%s)", cb->v.b ? "true" : "false");
+    break;
+  case SCR_DYN_NUM: {
+    char num[32];
+    size_t n = scr_f64_to_str(cb->v.num, num);
+    snprintf(detail, cap, "type number (%.*s)", (int)n, num);
+    break;
+  }
+  case SCR_DYN_STR: {
+    const ScrStr *sv = cb->v.str;
+    char insp[32];
+    size_t n = 0;
+    insp[n++] = '\'';
+    for (size_t i = 0; i < sv->len && n < 28; i++) insp[n++] = sv->data[i];
+    if (sv->len + 2 > 28) {
+      n = 25;
+      memcpy(insp + n, "...", 3);
+      n += 3;
+    } else {
+      insp[n++] = '\'';
+    }
+    snprintf(detail, cap, "type string (%.*s)", (int)n, insp);
+    break;
+  }
+  default: d = "an instance of Object"; break;
+  }
+  return d;
+}
+
+/* Node's ERR_INVALID_ARG_TYPE thrower ("The \"chunk\" argument must be
+ * of type string or an instance of Buffer or Uint8Array. Received type
+ * number (5)") — the handle dispatchers' and argument validators'
+ * per-arg gates. `expected` is the full "of type ..."/"an instance of
+ * ..." clause. */
+/* The compiler-resolved ERR_INVALID_ARG_TYPE throw with a RUNTIME-
+ * rendered Received tail (error.argTypeThrow — the always-throwing
+ * lowered arms whose offending value is not a literal). Borrows all
+ * three; always throws catchably. */
+void scr_throw_arg_type(const ScrStr *argname, const ScrStr *expected, const ScrDyn *got) {
+  scr_dyn_arg_type_fail(argname->data, expected->data, got);
+}
+
+void scr_dyn_arg_type_fail(const char *argname, const char *expected, const ScrDyn *got) {
+  char detail[64];
+  const char *d = scr_dyn_specific_type(got, detail, sizeof detail);
+  char msg[224];
+  int len = snprintf(msg, sizeof msg,
+                     "The \"%s\" argument must be %s. Received %s", argname, expected, d);
+  scr_throw_error_msg_code(SCR_ERR_TYPE, msg, (size_t)len, "ERR_INVALID_ARG_TYPE");
+}
+
 static void scr_dyn_handle_release(void *h, ScrDynHandleTag tag) {
   scr_dyn_handle_ops(tag)->release(h);
 }
@@ -1066,6 +1189,39 @@ ScrStr *scr_dyn_string_coerce(const ScrDyn *d) {
   return scr_dyn_to_string(d, NULL);
 }
 
+/* JS ToString over a DOM value WITH the object protocol (the WHATWG
+ * USVString conversions — URLSearchParams names/values): an OBJ whose
+ * own 'toString' member is callable is invoked with zero arguments (its
+ * throw propagates, catchably); a non-primitive answer falls through to
+ * 'valueOf' (ToPrimitive's string hint); exhaustion is the spec's
+ * "Cannot convert object to primitive value" TypeError. Every other
+ * kind matches scr_dyn_string_coerce (units RENDER — ToString(null) is
+ * "null"). Borrows; +1, or NULL with the exception pending. */
+ScrStr *scr_dyn_string_coerce_js(const ScrDyn *d) {
+  if (d->kind == SCR_DYN_OBJ) {
+    static const char *const hint[2] = { "toString", "valueOf" };
+    for (int i = 0; i < 2; i++) {
+      ScrDyn *m = scr_dyn_obj_get(d, hint[i], strlen(hint[i])); /* borrowed */
+      if (!m || m->kind != SCR_DYN_FUNC) continue;
+      ScrDyn *r = scr_dyn_call(m, NULL, 0, hint[i]);
+      if (!r) return NULL; /* the method threw — pending */
+      if (r->kind == SCR_DYN_OBJ || r->kind == SCR_DYN_ARR ||
+          r->kind == SCR_DYN_FUNC || r->kind == SCR_DYN_HANDLE ||
+          r->kind == SCR_DYN_PROMISE) {
+        scr_dyn_release(r); /* non-primitive answer: try the next method */
+        continue;
+      }
+      ScrStr *s = scr_dyn_string_coerce(r);
+      scr_dyn_release(r);
+      return s;
+    }
+    static const char msg[] = "Cannot convert object to primitive value";
+    scr_throw_error_msg(SCR_ERR_TYPE, msg, sizeof msg - 1);
+    return NULL;
+  }
+  return scr_dyn_string_coerce(d);
+}
+
 /* The checked-dynamic keyed WRITE (`h.k = v` on a dyn receiver): OBJ sets
  * the member (later writes win, insertion order — JS); undefined/null
  * throws Node's "Cannot set properties of ..."; every other kind throws

package/src/scr_lib.c

@@ -1647,7 +1647,7 @@ double scr_fs_read_sync(double fd, ScrBytes *buf, double offset, double length)
     mlen = snprintf(msg, sizeof msg,
                     "The value of \"offset\" is out of range. It must be >= 0 && <= 9007199254740991. Received %s",
                     numbuf);
-    scr_throw_error_msg(SCR_ERR_RANGE, msg, (size_t)mlen);
+    scr_throw_error_msg_code(SCR_ERR_RANGE, msg, (size_t)mlen, "ERR_OUT_OF_RANGE");
     return 0;
   }
   size_t off = (size_t)offset;
@@ -1656,7 +1656,7 @@ double scr_fs_read_sync(double fd, ScrBytes *buf, double offset, double length)
     mlen = snprintf(msg, sizeof msg,
                     "The value of \"length\" is out of range. It must be <= %zu. Received %s",
                     bytelen - off, numbuf);
-    scr_throw_error_msg(SCR_ERR_RANGE, msg, (size_t)mlen);
+    scr_throw_error_msg_code(SCR_ERR_RANGE, msg, (size_t)mlen, "ERR_OUT_OF_RANGE");
     return 0;
   }
   size_t want = (size_t)length;
@@ -2528,7 +2528,7 @@ ScrStr *scr_crypto_random_string(double n, ScrStr *enc) {
     int mlen = snprintf(msg, sizeof msg,
                         "The value of \"size\" is out of range. It must be >= 0 && <= 2147483647. Received %.*s",
                         (int)numlen, num);
-    scr_throw_error_msg(SCR_ERR_RANGE, msg, (size_t)mlen);
+    scr_throw_error_msg_code(SCR_ERR_RANGE, msg, (size_t)mlen, "ERR_OUT_OF_RANGE");
     return NULL;
   }
   size_t size = (size_t)n;
@@ -3486,6 +3486,104 @@ ScrStr *scr_num_to_fixed0(double x) {
   return r;
 }
 
+/* Increment a decimal digit string in place. Returns true on overflow —
+ * the value becomes 1 followed by len zeros (the caller folds the zeros
+ * into its scale); an EMPTY string increments to "1" the same way (the
+ * round-up-from-nothing case: 0.0005 at 3 fraction digits). */
+static bool scr_dec_inc(char *d, int len) {
+  for (int i = len - 1; i >= 0; i--) {
+    if (d[i] != '9') {
+      d[i]++;
+      return false;
+    }
+    d[i] = '0';
+  }
+  d[0] = '1';
+  return true;
+}
+
+/* Intl.NumberFormat("en-US").format(x) / x.toLocaleString("en-US") with
+ * DEFAULT options: decimal notation, minimum 0 / maximum 3 fraction
+ * digits, "," grouping every three integer digits, "∞"/"NaN" texts, and
+ * "-0" whenever the input is negative or negative zero even after
+ * rounding to zero. Rounding is half-up ON THE SHORTEST ROUND-TRIPPING
+ * DECIMAL — ICU's rounding input, probed against Node: format(1.0005) is
+ * "1.001" although the double is 1.000499... and toFixed(3) answers
+ * "1.000"; format(1e23) prints the shortest form's trailing zeros, not
+ * the double's exact expansion. The en-US/latn symbols (",", ".", "∞",
+ * "NaN", group size 3) are the whole embedded locale surface. Verified
+ * differentially against Node. Result +1; never throws. */
+ScrStr *scr_intl_num_format_en_us(double x) {
+  if (isnan(x)) return scr_str_new("NaN", 3);
+  if (isinf(x)) {
+    return x < 0 ? scr_str_new("-\xE2\x88\x9E", 4) : scr_str_new("\xE2\x88\x9E", 3);
+  }
+  bool neg = signbit(x) != 0;
+  if (x == 0) return neg ? scr_str_new("-0", 2) : scr_str_new("0", 1);
+  double a = neg ? -x : x;
+
+  /* Shortest digits: value = 0.d × 10^n (no trailing zeros, k ≤ 17). */
+  char d[18];
+  int n;
+  int k = scr_f64_digits(a, d, &n);
+
+  /* Round at 3 fraction digits: fraction position p is digit index
+   * n+p-1, so index n+3 is the first DROPPED digit. Half-up on the
+   * decimal digits — the shortest string ends right after them, so
+   * "first dropped digit ≥ 5" IS the whole decision. */
+  int keep = n + 3;
+  if (keep < k) {
+    bool up = keep >= 0 && d[keep] >= '5';
+    k = keep < 0 ? 0 : keep;
+    if (up && scr_dec_inc(d, k)) {
+      /* Carried out (all nines, or the round-up-from-nothing 0.0005
+       * case): one leading 1, the dropped nines fold into the scale. */
+      k = 1;
+      n += 1;
+    } else if (k == 0) {
+      /* Everything rounded away: ±0 with the sign preserved. */
+      return neg ? scr_str_new("-0", 2) : scr_str_new("0", 1);
+    }
+  }
+
+  /* Assemble: integer digits (indices [0, n)), zero-padded past k, then
+   * the ≤ 3 fraction digits (indices n..n+2, '0' outside [0, k)) with
+   * trailing zeros trimmed, then commas every three integer digits. */
+  char frac[3];
+  int flen = 0;
+  for (int p = 1; p <= 3; p++) {
+    int idx = n + p - 1;
+    frac[flen++] = (idx >= 0 && idx < k) ? d[idx] : '0';
+  }
+  while (flen > 0 && frac[flen - 1] == '0') flen--;
+
+  char out[512];
+  int o = 0;
+  if (neg) out[o++] = '-';
+  if (n <= 0) {
+    out[o++] = '0';
+  } else {
+    for (int i = 0; i < n; i++) {
+      if (i > 0 && (n - i) % 3 == 0) out[o++] = ',';
+      out[o++] = (i < k) ? d[i] : '0';
+    }
+  }
+  if (flen > 0) {
+    out[o++] = '.';
+    memcpy(out + o, frac, (size_t)flen);
+    o += flen;
+  }
+  return scr_str_new(out, (size_t)o);
+}
+
+/* Object.is over two numbers — the spec's SameValue on doubles: NaN
+ * equals NaN, +0 differs from -0, everything else is ==. */
+bool scr_num_same_value(double a, double b) {
+  if (a != a) return b != b;
+  if (a == 0 && b == 0) return signbit(a) == signbit(b);
+  return a == b;
+}
+
 bool scr_num_is_nan(double x) { return isnan(x) != 0; }
 
 bool scr_num_is_integer(double x) { return isfinite(x) && trunc(x) == x; }

package/src/scr_library.c

@@ -40,7 +40,19 @@ void scr_library_set_sink(ScrLibSinkFn fn, void *ctx) {
  * conforming survival pattern), then deliver exactly once, then abort:
  * before registration, or if the sink returns (the ruled host-contract
  * violation). The address is the funnel frame's return address — the trap
- * site — 0 where the toolchain cannot supply one. */
+ * site — 0 where the toolchain cannot supply one.
+ *
+ * Delivery shape (the ratified structured trap-teaching encoding): a
+ * message that already begins with the 0x01 marker — a facade-authored
+ * structured throw riding the verbatim rule, or the wrapper's compile-
+ * time-assembled SC4012 contract trap — is delivered byte-for-byte. Every
+ * OTHER message is a trap the runtime DETECTED, and the funnel assembles
+ * it here into 0x01 text 0x1F code 0x1F symbol [0x1F remediation]: the
+ * baseline human line becomes field 0 unchanged (so plain-text hosts read
+ * exactly what they always read), the code classifies the trap kind, the
+ * symbol is the entry the trapping call came through (recorded by the
+ * entry prologue below), and the remediation is the profile's for that
+ * code when the program TU's overlay table declares one. */
 
 #if defined(__GNUC__) || defined(__clang__)
 #define SCR_TRAP_ADDR() ((uint64_t)(uintptr_t)__builtin_return_address(0))
@@ -48,8 +60,95 @@ void scr_library_set_sink(ScrLibSinkFn fn, void *ctx) {
 #define SCR_TRAP_ADDR() ((uint64_t)0)
 #endif
 
+/* The current-entry slot: every generated entry's prologue records its
+ * external symbol before dispatching into core code. A single static slot
+ * is sound — exactly one core is live per process (the one-live-core rule),
+ * entries never nest, and a trap can only fire while an entry is on the
+ * stack. NULL (never entered) renders as the empty symbol field. */
+static const char *scr_library_entry_symbol = NULL;
+
+/* Detected-trap classification: the runtime's trap sites self-classify
+ * through their message conventions (the exact bytes the executable lane
+ * prints), so the kind → code mapping keys on those prefixes. The codes are
+ * the compiler registry's runtime family (diagnostics/diagnostic.ts —
+ * documented beside SC4012); SC4019 is the family's residual for detected
+ * traps outside the named kinds (environment failures, unsupported
+ * operations, the RC audit). */
+static const struct {
+  const char *prefix;
+  const char *code;
+} scr_library_trap_kinds[] = {
+  {"Uncaught ", "SC4013"},                  /* escaped exception at an entry */
+  {"scriptc: RangeError: ", "SC4014"},      /* range trap */
+  {"scriptc: TypeError: ", "SC4015"},       /* type trap */
+  {"scriptc: SyntaxError: ", "SC4016"},     /* syntax trap (regex compile) */
+  {"scriptc: out of memory", "SC4017"},     /* allocation failure */
+  {"scriptc: internal error: ", "SC4018"},  /* internal invariant failure */
+};
+
+static const char *scr_library_trap_code(const char *msg, size_t len) {
+  for (size_t i = 0; i < sizeof scr_library_trap_kinds / sizeof scr_library_trap_kinds[0]; i++) {
+    size_t plen = strlen(scr_library_trap_kinds[i].prefix);
+    if (len >= plen && memcmp(msg, scr_library_trap_kinds[i].prefix, plen) == 0) {
+      return scr_library_trap_kinds[i].code;
+    }
+  }
+  return "SC4019"; /* other detected trap */
+}
+
 static _Noreturn void scr_library_trap_deliver(const char *msg, size_t len, uint64_t addr) {
   scr_library_poisoned = true;
+  if (!(len > 0 && (uint8_t)msg[0] == 0x01)) {
+    /* A detected trap: assemble the structured message. Static buffer —
+     * no malloc on the failure path; text truncates before structure ever
+     * would (codes and symbols are short; an oversized remediation drops
+     * whole, never split). */
+    static char buf[2048];
+    const char *code = scr_library_trap_code(msg, len);
+    const char *text = msg;
+    size_t text_len = len;
+    const char *rem = NULL;
+    for (size_t i = 0; i < scr_library_trap_overlays_len; i++) {
+      const char *const *t = &scr_library_trap_overlays[3 * i];
+      if (strcmp(t[0], code) == 0) {
+        if (t[1] != NULL) {
+          text = t[1];
+          text_len = strlen(t[1]);
+        }
+        rem = t[2];
+        break;
+      }
+    }
+    const char *sym = scr_library_entry_symbol != NULL ? scr_library_entry_symbol : "";
+    size_t tail = 2 + strlen(code) + strlen(sym);
+    if (rem != NULL) {
+      if (tail + 1 + strlen(rem) > sizeof buf - 1) rem = NULL; /* drop whole, keep structure */
+      else tail += 1 + strlen(rem);
+    }
+    size_t n = 0;
+    buf[n++] = '\x01';
+    size_t cap = sizeof buf - 1 - tail;
+    if (text_len > cap) text_len = cap;
+    for (size_t i = 0; i < text_len; i++) {
+      /* The encoding reserves 0x01/0x1F; runtime messages never contain
+       * them, but an escaped exception's rendered text embeds user bytes. */
+      char c = text[i];
+      buf[n++] = (c == '\x01' || c == '\x1f') ? ' ' : c;
+    }
+    buf[n++] = '\x1f';
+    memcpy(buf + n, code, strlen(code));
+    n += strlen(code);
+    buf[n++] = '\x1f';
+    memcpy(buf + n, sym, strlen(sym));
+    n += strlen(sym);
+    if (rem != NULL) {
+      buf[n++] = '\x1f';
+      memcpy(buf + n, rem, strlen(rem));
+      n += strlen(rem);
+    }
+    msg = buf;
+    len = n;
+  }
   if (scr_library_sink != NULL) {
     scr_library_sink(scr_library_sink_ctx, (const uint8_t *)msg, len, addr);
   }
@@ -80,7 +179,11 @@ __attribute__((noinline)) _Noreturn void scr_trap_fmt(const char *fmt, ...) {
 
 /* ── entry prologues ──────────────────────────────────────────────────── */
 
-void scr_library_entry(bool reset_arena) {
+void scr_library_entry(bool reset_arena, const char *entry_symbol) {
+  /* Record the entry symbol FIRST so even a poisoned-abort's core dump
+   * names the entry; a trap anywhere below (the arena reset's OOM
+   * included) then reports the right symbol. */
+  scr_library_entry_symbol = entry_symbol;
   /* A poisoned library's entries abort deterministically — never through the
    * sink again (it received its exactly-once message when the trap fired),
    * never into a heap whose invariants already failed. */

package/src/scr_number.c

@@ -24,27 +24,19 @@
  * unchanged. Provides d2d(), d2d_small_int(), decimalLength17(), div10(). */
 #include "../vendor/ryu/d2s.c"
 
-size_t scr_f64_to_str(double x, char *buf) {
-  if (isnan(x)) return (size_t)(stpcpy(buf, "NaN") - buf);
-  if (x == 0) return (size_t)(stpcpy(buf, "0") - buf); /* covers -0 */
-  if (isinf(x)) {
-    return (size_t)(stpcpy(buf, x < 0 ? "-Infinity" : "Infinity") - buf);
-  }
-
-  char *out = buf;
-  if (x < 0) {
-    *out++ = '-';
-    x = -x;
-  }
-
-  /* Shortest round-tripping digits via Ryū. Mirrors d2s_buffered_n's
-   * dispatch: the exact small-integer fast path first (trailing decimal
-   * zeros folded into the exponent), the full algorithm otherwise. */
+/* The Ryū digit core, shared by the ECMA placement below and the Intl
+ * en-US number formatter (scr_lib.c): the shortest round-tripping digit
+ * string for a positive finite double — value = 0.digits × 10^n with no
+ * trailing zeros. Returns k (the digit count, ≤ 17); digits is
+ * NUL-terminated. Mirrors d2s_buffered_n's dispatch: the exact
+ * small-integer fast path first (trailing decimal zeros folded into the
+ * exponent), the full algorithm otherwise. */
+int scr_f64_digits(double x, char digits[18], int *n_out) {
   uint64_t bits;
   memcpy(&bits, &x, sizeof bits);
   const uint64_t ieeeMantissa = bits & ((1ull << DOUBLE_MANTISSA_BITS) - 1);
   const uint32_t ieeeExponent =
-      (uint32_t)(bits >> DOUBLE_MANTISSA_BITS); /* sign already stripped */
+      (uint32_t)(bits >> DOUBLE_MANTISSA_BITS); /* sign must be stripped */
   floating_decimal_64 v;
   if (d2d_small_int(ieeeMantissa, ieeeExponent, &v)) {
     for (;;) {
@@ -60,9 +52,8 @@ size_t scr_f64_to_str(double x, char *buf) {
 
   /* Ryū's (mantissa, exponent) → ECMA's (digits, k, n): the k mantissa
    * digits have no trailing zeros, and value = 0.digits * 10^n. */
-  char digits[18];
   int k = (int)decimalLength17(v.mantissa);
-  int n = v.exponent + k;
+  *n_out = v.exponent + k;
   digits[k] = '\0';
   uint64_t m = v.mantissa;
   for (int i = k - 1; i >= 0; i--) {
@@ -70,6 +61,25 @@ size_t scr_f64_to_str(double x, char *buf) {
     digits[i] = (char)('0' + (uint32_t)m - 10 * (uint32_t)q);
     m = q;
   }
+  return k;
+}
+
+size_t scr_f64_to_str(double x, char *buf) {
+  if (isnan(x)) return (size_t)(stpcpy(buf, "NaN") - buf);
+  if (x == 0) return (size_t)(stpcpy(buf, "0") - buf); /* covers -0 */
+  if (isinf(x)) {
+    return (size_t)(stpcpy(buf, x < 0 ? "-Infinity" : "Infinity") - buf);
+  }
+
+  char *out = buf;
+  if (x < 0) {
+    *out++ = '-';
+    x = -x;
+  }
+
+  char digits[18];
+  int n;
+  int k = scr_f64_digits(x, digits, &n);
 
   if (k <= n && n <= 21) {
     /* Integer: digits followed by n-k zeros. */

package/src/scr_runtime.h

@@ -48,8 +48,10 @@ void scr_init(void);
  * the host-registered panic sink and abort only as the last resort: before
  * registration, or if the sink returns (the ruled host-contract violation —
  * a conforming sink longjmps to a host frame BELOW the entry, never back
- * into library frames). Messages keep their trailing newline in both lanes so
- * the funnel is a pure indirection over identical bytes. */
+ * into library frames). Messages keep their trailing newline in both lanes;
+ * the library funnel additionally assembles every DETECTED trap into the
+ * structured trap-teaching form before delivery (a message that already
+ * begins with the 0x01 marker passes verbatim) — see ScrLibSinkFn below. */
 _Noreturn void scr_trap(const char *msg);
 _Noreturn void scr_trap_fmt(const char *fmt, ...);
 
@@ -82,7 +84,17 @@ typedef struct ScrBytes ScrBytes;
  * diagnostic code, 2 the trapping symbol as the host linked it, 3 the
  * remediation; a missing or empty field means none; ignore any field past
  * the fourth. Fields are (pointer, length) — never assume NUL termination.
- * A plain-text host may print the whole buffer: the teaching leads it. */
+ * A plain-text host may print the whole buffer: the teaching leads it.
+ *
+ * Every trap the runtime DETECTS arrives structured: the funnel assembles
+ * the baseline human line into field 0 unchanged, a stable code for the
+ * trap kind (the compiler registry's SC4013–SC4019 runtime family,
+ * classified in scr_library.c), the entry symbol recorded by the trapping
+ * entry's prologue, and the profile's remediation for that code when the
+ * program TU's overlay table declares one (the whole fourth field is
+ * absent otherwise). A message that already begins with the marker — a
+ * facade-authored structured throw, or the wrapper's compile-time-
+ * assembled SC4012 contract trap — passes through byte-for-byte. */
 typedef void (*ScrLibSinkFn)(void *ctx, const uint8_t *msg, size_t msg_len,
                               uint64_t address);
 void scr_library_set_sink(ScrLibSinkFn fn, void *ctx); /* latest wins */
@@ -90,8 +102,15 @@ void scr_library_set_sink(ScrLibSinkFn fn, void *ctx); /* latest wins */
 /* Entry prologue: aborts deterministically when the library is poisoned (a
  * trap already fired — no profile entry may run again; recovery is process
  * restart). reset_arena additionally drops the result arena (the
- * auto-reset posture, and the reset/collect entries' shared body). */
-void scr_library_entry(bool reset_arena);
+ * auto-reset posture, and the reset/collect entries' shared body).
+ * entry_symbol is the generated entry's external symbol exactly as the
+ * host linked it (a static string in the program TU): the prologue records
+ * it in the funnel's current-entry slot so a detected trap's structured
+ * message can name the trapping entry — sound as a single static slot
+ * because exactly one core is ever live and entries never nest. Init and
+ * the mode entries (reset, collect) record theirs too; the identity
+ * getters and sink registration touch no runtime and never trap. */
+void scr_library_entry(bool reset_arena, const char *entry_symbol);
 void scr_library_arena_reset(void);
 /* The mode-provided collect entry's body: arena reset + a full cycle
  * collection (snapshot-invariant by construction — collection frees only
@@ -124,6 +143,16 @@ void scr_library_check_exc(void);
  * structured message is length-delimited, never NUL-scanned. */
 _Noreturn void scr_trap_len(const char *msg, size_t len);
 
+/* The runtime-trap overlay table, DEFINED by the generated program TU
+ * (both emissions emit identical data) and consumed by the funnel when it
+ * assembles a detected trap's structured message: flat triples of
+ * (code, teaching-or-NULL, remediation-or-NULL), one per runtime trap code
+ * (SC4013–SC4019 family) the profile declares text for; _len counts
+ * triples. A declared teaching replaces the baseline human line as field 0;
+ * a declared remediation becomes the optional fourth field. */
+extern const char *const scr_library_trap_overlays[];
+extern const size_t scr_library_trap_overlays_len;
+
 /* Marshalling helpers the generated wrappers call (both emissions share
  * these bodies, which is how the two lanes stay identical by
  * construction). Inbound is borrowed-and-copied; outbound values MOVE into
@@ -449,6 +478,9 @@ void scr_undef_global_read(ScrStr *name);
 void scr_error_set_code(ScrError *e, const char *code);
 ScrStr *scr_error_code(ScrError *e);
 void scr_throw_error_msg_code(int kind, const char *message, size_t len, const char *code);
+/* The compiler-resolved Node-parity throw (error.nodeThrow): builtin
+ * error of `kind`, `code` stamped when non-empty. Borrows both. */
+void scr_throw_node_coded(double kind, const ScrStr *code, const ScrStr *msg);
 
 /* ── string methods ─────────────────────────────────────────────────
  * ECMA-262 observable semantics (UTF-16 code units) computed over the
@@ -1552,6 +1584,13 @@ bool scr_stream_push_dyn(ScrStream *s, const ScrDyn *d);       /* borrows d; tag
 bool scr_stream_write_dyn(ScrStream *s, const ScrDyn *d, ScrClosure *cb); /* cb moves */
 ScrPromise *scr_stream_next_chunk(ScrStream *s);
 ScrPromise *scr_stream_next_chunk_dyn(ScrStream *s);
+/* node:stream/promises — the promise forms over the finished/pipeline
+ * machinery above: a pending void promise the terminal watcher settles
+ * (fulfilled on a clean finish, rejected with the finish status
+ * otherwise — the stream's error or ERR_STREAM_PREMATURE_CLOSE).
+ * Streams borrowed; +1 promises. */
+ScrPromise *scr_sp_finished(ScrStream *s);
+ScrPromise *scr_sp_pipeline(double n, ScrStream **streams);
 /* Readable.from(array): +1 fully-seeded object-entry stream (one WHOLE
  * chunk per element — strings or Buffers per the flag; hwm 1, already
  * EOF'd). Borrows arr. */
@@ -2706,6 +2745,14 @@ ScrDyn *scr_dyn_new_buffer_copy(const ScrBytes *b);
  * extraction (`u as Uint8Array`). */
 ScrBytes *scr_dyn_bytes_copy_out(const ScrDyn *d);
 void scr_dyn_arr_push(ScrDyn *arr, ScrDyn *item);
+/* Spread completion for a runtime-arity argument list (`f(...xs)` in the
+ * checked-dynamic tier): flattens `src` into `arr` per JS's spread over the
+ * DOM's iterable kinds — arrays element-by-element (retained), strings by
+ * code POINT (the string iterator), bytes by byte — and throws V8's exact
+ * SPREAD-CALL TypeError for every other kind (pending; callers check):
+ * nullish sources spell the spread expression (`what`), everything else is
+ * the generic "Spread syntax requires ..." text. Borrows src. */
+void scr_dyn_arr_push_spread(ScrDyn *arr, const ScrDyn *src, const char *what);
 void scr_dyn_obj_set(ScrDyn *obj, const char *key, size_t key_len, ScrDyn *value);
 /* The checked-dynamic keyed WRITE (`h.k = v` on a dyn receiver): OBJ sets
  * the member (JS: later writes win, insertion order); undefined/null and
@@ -2722,6 +2769,10 @@ ScrStr *scr_dyn_to_string(const ScrDyn *d, const ScrStr *enc);
 /* JS String() over the DOM kind (units render "null"/"undefined" where
  * scr_dyn_to_string throws) — the web globals' WebIDL ToString. +1. */
 ScrStr *scr_dyn_string_coerce(const ScrDyn *d);
+/* JS ToString WITH the object protocol (user toString/valueOf members
+ * called, their throws propagating) — the WHATWG USVString conversions.
+ * Borrows; +1 or NULL with the exception pending. */
+ScrStr *scr_dyn_string_coerce_js(const ScrDyn *d);
 
 /* `d instanceof TypeError` (and the other builtin error classes) on a
  * checked-dynamic value: the from_error cache resolves the DOM encoding
@@ -2792,6 +2843,10 @@ ScrDyn *scr_dyn_new_func(ScrClosure *clo, ScrDynThunk thunk, uint32_t arity, con
  * boxed thunk (per-arg checks live there). `args` entries are BORROWED;
  * the result is owned (+1), or NULL with the exception pending. */
 ScrDyn *scr_dyn_call(const ScrDyn *d, ScrDyn *const *args, size_t argc, const char *what);
+/* scr_dyn_call over a DOM ARRAY's elements (the spread-application form —
+ * `f(...args)` after the emitted argument array is built): argv IS the
+ * array's items. Borrows both; result owned (+1), or NULL pending. */
+ScrDyn *scr_dyn_apply(const ScrDyn *d, const ScrDyn *args, const char *what);
 
 /* Path spine for dynCheck error messages — a compile-time-shaped linked
  * list the emitted builders stack-allocate per recursion level: `key`
@@ -2932,6 +2987,9 @@ void scr_dyn_check_listener(const ScrDyn *cb, const char *argname);
  * generic ERR_INVALID_ARG_TYPE thrower over it (`expected` is the whole
  * "of type ..." clause). The handle dispatchers' per-arg gates. */
 const char *scr_dyn_specific_type(const ScrDyn *v, char *buf, size_t cap);
+/* ERR_INVALID_ARG_TYPE with the runtime-rendered Received tail (the
+ * error.argTypeThrow libCall). Borrows all three; always throws. */
+void scr_throw_arg_type(const ScrStr *argname, const ScrStr *expected, const ScrDyn *got);
 void scr_dyn_arg_type_fail(const char *argname, const char *expected, const ScrDyn *got);
 /* Listener-closure builders for the handle dispatchers' .on(...) paths:
  * a runtime-built ScrClosure whose capture is the boxed dyn listener and
@@ -3720,6 +3778,13 @@ ScrJsval *scr_jsval_call_method(ScrJsval *o, const ScrStr *name, int argc, ScrJs
  * anything else calls with this = o (non-callables throw in the engine). */
 ScrJsval *scr_jsval_opt_call_method(ScrJsval *o, const ScrStr *name, int argc, ScrJsval **argv);
 ScrJsval *scr_jsval_call(ScrJsval *f, int argc, ScrJsval **argv);
+/* Spread application on an island callee — `f(...pre, ...spread)` through
+ * the prelude helper's REAL spread syntax (iterator protocols are the
+ * engine's own; the guards front-run V8's exact spread-call TypeError
+ * texts). `pre` is the engine array of leading fixed arguments; `what` the
+ * spread expression's source spelling (the nullish text spells it).
+ * Borrows everything; +1 out, or NULL with the exception bridged. */
+ScrJsval *scr_jsval_call_spread(ScrJsval *f, ScrJsval *pre, ScrJsval *spread, const ScrStr *what);
 /* `new X(...)` on an island callee (jsOp construct) — JS_CallConstructor.
  * Borrows everything; +1 out, or NULL with the exception bridged. */
 ScrJsval *scr_jsval_construct(ScrJsval *f, int argc, ScrJsval **argv);
@@ -3867,6 +3932,12 @@ void scr_jsval_cast_fail(ScrJsval *v, const ScrStr *target);
  */
 size_t scr_f64_to_str(double x, char *buf);
 
+/* The Ryū digit core (scr_number.c), shared with the Intl en-US number
+ * formatter: the shortest round-tripping digits of a POSITIVE finite
+ * double — value = 0.digits × 10^n, no trailing zeros, NUL-terminated.
+ * Returns k, the digit count (≤ 17). */
+int scr_f64_digits(double x, char digits[18], int *n_out);
+
 /* ToString for template literals / string coercion. Returns +1. */
 ScrStr *scr_f64_to_scrstr(double x);
 ScrStr *scr_bool_to_scrstr(bool b); /* interned "true"/"false" */
@@ -3898,6 +3969,18 @@ bool scr_num_is_safe_integer(double x);
 ScrStr *scr_num_to_exponential(double x);
 ScrStr *scr_num_to_fixed0(double x);
 
+/* Object.is over two numbers — the spec's SameValue on doubles: NaN
+ * equals NaN, +0 differs from -0, everything else is ==. Never throws. */
+bool scr_num_same_value(double a, double b);
+
+/* Intl.NumberFormat("en-US").format(x) / x.toLocaleString("en-US") with
+ * default options: decimal notation, 0–3 fraction digits rounded half-up
+ * on the shortest round-tripping decimal (ICU's rounding input — NOT
+ * toFixed's exact-value rounding), "," grouping every three integer
+ * digits, "∞"/"NaN" texts, "-0" for negative inputs rounding to zero.
+ * en-US is the one embedded locale. Result +1; never throws. */
+ScrStr *scr_intl_num_format_en_us(double x);
+
 /* ── Date, the composed slice (scr_lib.c) ─────────────────────────────
  * Date values have no representation; the runtime surface is exactly
  * Date.now() and toISOString over a millisecond time value. */
@@ -4052,6 +4135,14 @@ typedef enum ScrDataViewGet {
 } ScrDataViewGet;
 double scr_dataview_get(const ScrBytes *b, double byte_off, ScrDataViewGet kind, bool le);
 
+/* DataView setters (the integer/float kinds only — the BIG kinds never
+ * lower: bigint arguments have no representation). Values coerce
+ * JS-exactly: the integer kinds by modular truncation (ToUint32's residue
+ * — the narrower widths store its low bytes, the same 2^width residue),
+ * F32 by double→float round-to-nearest-even. Offsets go through ToIndex
+ * with the getters' one RangeError. */
+void scr_dataview_set(ScrBytes *b, double byte_off, double value, ScrDataViewGet kind, bool le);
+
 /* Element read/write. Any invalid index — negative, fractional, NaN, or
  * out of bounds — TRAPS like the array runtime (SEMANTICS.md documents
  * the divergence from JS's undefined-read/ignored-write). Writes coerce
@@ -4122,6 +4213,32 @@ bool scr_bytes_is_encoding(const ScrStr *s);
 bool scr_bytes_equals(const ScrBytes *a, const ScrBytes *b);
 double scr_bytes_compare(const ScrBytes *src, const ScrBytes *target, double nargs,
                          double ts, double te, double ss, double se);
+/* Node's validateOffset ladder (buffer.js): non-integers (±Infinity and
+ * NaN included) throw the 'an integer' ERR_OUT_OF_RANGE RangeError, the
+ * rest the '>= 0 && <= max' render; max < 0 drops the upper bound.
+ * Returns false after arming the pending throw. */
+bool scr_bytes_validate_off(const char *name, double value, double max);
+/* The checked-dynamic compare/equals validators (scr_bytes_io.c): Node's
+ * argument ladder over DOM-boxed arguments — a non-bytes value throws
+ * ERR_INVALID_ARG_TYPE with the API's own argument name ("buf1"/"buf2",
+ * "otherBuffer", "target"), non-number offsets ERR_INVALID_ARG_TYPE
+ * "of type number", out-of-range numbers the validateOffset RangeError;
+ * an undefined offset takes its Node default. All arguments BORROWED. */
+double scr_buffer_compare_chk(const ScrDyn *a, const ScrDyn *b);
+bool scr_bytes_equals_chk(const ScrBytes *recv, const ScrDyn *other);
+double scr_bytes_compare_chk(const ScrBytes *src, const ScrDyn *target,
+                             const ScrDyn *ts, const ScrDyn *te,
+                             const ScrDyn *ss, const ScrDyn *se);
+/* new Buffer(number, encoding)'s string-arm type error (always throws;
+ * borrowed). */
+ScrBytes *scr_buffer_new_string_fail(const ScrDyn *got);
+/* fs._toUnixTimestamp over a DOM time value: numeric strings and finite
+ * numbers coerce (negatives answer now/1000), the rest throw Node's
+ * ERR_INVALID_ARG_TYPE. Borrowed. */
+double scr_fs_to_unix_timestamp(const ScrDyn *t);
+/* The checked-dynamic max-listeners ladders (scr_events_emitter.c). */
+ScrEmitter *scr_emitter_set_max_chk(ScrEmitter *em, const ScrDyn *n);
+void scr_emitter_set_default_max_chk(const ScrDyn *n, const ScrStr *name);
 double scr_bytes_index_of(const ScrBytes *b, const ScrBytes *needle, double off, double align, bool fwd);
 double scr_bytes_index_of_num(const ScrBytes *b, double v, double off, bool fwd);
 ScrBytes *scr_bytes_fill(ScrBytes *b, const ScrBytes *pattern, double nargs, double offset, double end);

package/src/scr_stream.c

@@ -683,7 +683,9 @@ static void *scr_stream_read_n(ScrStream *s, double size) {
       st->r.hwm = h;
     }
   }
-  if (!absent && n != 0) st->r.emitted_readable = false;
+  /* Node's read(): `if (n !== 0) state.emittedReadable = false` — the
+   * absent form is NaN there, which also clears; only read(0) keeps it. */
+  if (absent || n != 0) st->r.emitted_readable = false;
   if (!absent && n == 0 && st->r.need_readable &&
       (st->r.length >= st->r.hwm || st->r.ended)) {
     if (st->r.length == 0 && st->r.ended) scr_stream_end_readable(s);
@@ -2148,6 +2150,49 @@ ScrStream *scr_stream_pipeline(double n_d, ScrStream **streams /*borrowed*/,
   return scr_stream_retain(streams[n - 1]);
 }
 
+/* ── node:stream/promises ─────────────────────────────────────────────
+ * The promise forms ride the callback machinery above with a settling
+ * watcher: caps[0] boxes the pending promise; the terminal status
+ * fulfills (NULL) or rejects (the error moves through the exception
+ * cell, the reject-pending pattern). */
+
+static void scr_sp_settle_inv(ScrClosure *cb, ScrStream *s, ScrError *err) {
+  (void)s;
+  ScrPromise *p = scr_box_get_ref(cb->caps[0]); /* +1 */
+  if (err != NULL) {
+    scr_throw_obj(scr_error_retain(err), &scr_error_retain_v, &scr_error_release_v,
+                  scr_error_trace_arg());
+    scr_promise_reject_pending(p);
+  } else {
+    scr_promise_fulfill_void(p);
+  }
+  scr_promise_release(p);
+}
+
+static ScrClosure *scr_sp_watcher(ScrPromise *p /*borrowed*/) {
+  ScrClosure *w = scr_closure_new((void *)&scr_sp_settle_inv, 1);
+  w->caps[0] = scr_box_new_obj(scr_promise_retain_v, scr_promise_release_v, scr_promise_trace_v);
+  scr_box_set_ref(w->caps[0], scr_promise_retain(p));
+  return w;
+}
+
+ScrPromise *scr_sp_finished(ScrStream *s) {
+  ScrPromise *p = scr_promise_new();
+  /* The cleanup closure is the callback form's return value; the promise
+   * form exposes no unhook, so it drops here (the watcher stays parked —
+   * scr_stream_finished retained it into the stream's list). */
+  ScrClosure *cleanup = scr_stream_finished(s, scr_sp_watcher(p), &scr_sp_settle_inv);
+  scr_closure_release(cleanup);
+  return p;
+}
+
+ScrPromise *scr_sp_pipeline(double n, ScrStream **streams) {
+  ScrPromise *p = scr_promise_new();
+  ScrStream *dst = scr_stream_pipeline(n, streams, scr_sp_watcher(p), &scr_sp_settle_inv);
+  scr_stream_release(dst);
+  return p;
+}
+
 /* ── the readable surface ─────────────────────────────────────────────── */
 
 bool scr_stream_push(ScrStream *s, ScrBytes *chunk) {
@@ -2664,10 +2709,12 @@ double scr_stream_prop(ScrStream *s, const char *name) {
  * arrives outside a _read call). */
 static void scr_stream_emit_readable_now(ScrStream *s) {
   ScrStreamState *st = s->st;
-  st->r.emitted_readable = false;
+  /* Node's emitReadable_ clears emittedReadable AFTER the emit (a
+   * 'readable' listener observes true) and only when it really fired. */
   if (!st->destroyed && !st->errored && (st->r.length > 0 || st->r.ended)) {
     scr_stream_emit0(s, "readable");
     if (scr_exc_pending()) return;
+    st->r.emitted_readable = false;
   }
   st->r.need_readable = st->r.flowing != 1 && !st->r.ended &&
                         st->r.length <= st->r.hwm;