xbintsc 0.3.81 → 0.3.87

package/doc/unimplemented.md

@@ -68,8 +68,9 @@ None — generators are implemented.
 > Tagged templates are implemented, including raw strings and `String.raw`.
 > Generators (`function*`, `yield`, `yield*`) are implemented with stackful
 > coroutines, including `next`/`throw`/`return`, `for...of`, spread and
-> delegation. `import.meta` is parsed but has no runtime value; `async`
-> generators are not yet supported.
+> delegation. `import.meta` exposes `url`, `dirname` and `filename`, resolved
+> from the running executable's path. `async function*` is **rejected with
+> `UnsupportedFeature`** instead of silently producing a synchronous generator.
 
 ### 2.2 Not supported by the parser
 
@@ -79,7 +80,7 @@ None known at the expression level.
 
 | Operator | Status | Notes |
 | --- | --- | --- |
-| `new.target` | ✗ | not implemented |
+| `new.target` | ✗ | parsed, then rejected with `UnsupportedFeature` (no `new.target` semantics) |
 | `typeof` / `void` / `in` / `delete` / `instanceof` | ✓ | mapped to runtime helpers (`xt_typeof`, `xt_in`, `xt_delete`, `xt_instance_of`) |
 
 ---
@@ -132,7 +133,7 @@ element writes, and `fill` / `set` / `slice` / `subarray` / `join` / `toString`
 | `keys` / `values` / `entries` | ~ return arrays, not iterator objects |
 | `ArrayBuffer` / `DataView` / `.buffer` / `.byteOffset` semantics | ✗ no backing buffer type; `.byteOffset` is always 0 |
 | `BigInt64Array` / `BigUint64Array` | ✗ not implemented |
-| `instanceof Uint8Array` | ✗ global constructors are not first-class values, so `x instanceof Uint8Array` fails with `Cannot find name 'Uint8Array'` |
+| `instanceof` built-in constructors | ✓ `instanceof Array` / `Object` / `Map` / `Set` / `Date` / `RegExp` / `Promise` / `Error` family / typed arrays are recognised by name; the constructors are still not first-class values (`const A = Array` fails) |
 | Typed-array views over a `Buffer` / `ArrayBuffer` | ✗ constructors copy from a length / array-like / typed array only |
 
 ---
@@ -169,8 +170,8 @@ element writes, and `fill` / `set` / `slice` / `subarray` / `join` / `toString`
 | `arguments` object | ✓ (implicit) | ✓ implemented (arrow functions get their own parameters, not the outer function's `arguments`, unlike JS) |
 | `this` binding / method call semantics | ✓ | ✓ implemented (`this` is threaded as the first ABI parameter; arrow functions inherit lexically) |
 | `async` / `await` / Promise | ✓ | ✓ implemented (synchronous microtask model) |
-| `new.target` | ✗ | not implemented |
-| Generators / iterators / `yield` | ✓ implemented | `function*`, `yield`, `yield*`, `.next/.throw/.return`; `async` generators not supported |
+| `new.target` | ✗ | parsed, then rejected with `UnsupportedFeature` (no `new.target` semantics) |
+| Generators / iterators / `yield` | ✓ implemented | `function*`, `yield`, `yield*`, `.next/.throw/.return`; `async` generators are rejected with `UnsupportedFeature` |
 | Closure `arity` | — | `xt_closure_arity` is always -1, never filled in |
 | `fn.call` / `fn.apply` / `fn.bind` | ✓ | ✓ implemented (the bound closure does not track partial-argument `length`) |
 | `fn.name` / `fn.length` | ✓ | ✓ implemented (inferred from the declaration / assignment / property key; bound functions use `"bound ..."` and adjusted arity) |
@@ -232,9 +233,9 @@ These features **compile and run**, but the result does not fully match ECMAScri
 | Function `arity` / argument count | No argument count validation; `fn.length` reports the declared arity but calls are never checked against it |
 | `async` / `await` | **Synchronous microtask model**: `await` on an already-settled promise continues synchronously. Timers and sockets run on the event loop only after the program body, so a promise settled from a timer callback cannot be awaited |
 | `super` | `super.x` / `super(...)` takes the prototype of `this`'s prototype; single-level inheritance is correct, but depth > 1 may be inaccurate |
-| `Error.stack` | Not captured |
+| `Error.stack` | Function-level frames only: each frame is `at name (file:line)` with the function's declaration line (updated to the construction line for the innermost frame); no column numbers and no frames for generator bodies (they switch stacks) |
 | Module live bindings | Namespace imports and imported bindings are snapshots (see section 4) |
-| `import.meta` | Parsed but has no value |
+| `import.meta` | ✓ `import.meta.url` / `.dirname` / `.filename`, resolved from the executable path |
 
 > Number formatting, loose equality, `+` / relational `ToPrimitive`, whole-chain
 > optional chaining, `finally` on early exit and object-key ordering have all
@@ -263,9 +264,9 @@ These features **compile and run**, but the result does not fully match ECMAScri
 ```
 Unimplemented (statements): namespace/module declarations
 
-Unimplemented (expressions): new.target, import.meta value
+Unimplemented (expressions): new.target (clear UnsupportedFeature)
 
-Unimplemented (functions): `fn.toString()` source text, async generators
+Unimplemented (functions): `fn.toString()` source text, async generators (rejected)
 
 Unimplemented (classes/OO): abstract/implements, access control,
                             parent/child #x collision

package/doc/zh-CN/DESIGN.md

@@ -39,13 +39,18 @@ xt_value fn(xt_value env, int32_t argc, xt_value *argv);
 ```
 
 `env` 通过 box 以引用方式传递捕获变量，直接调用与闭包调用共用一条代码路径。
-不易内联的 JS 语义（`+` 隐式转换、关系比较、属性访问、打印）委托给 `@xt_*` 运行时调用。
+不易内联的 JS 语义（`+` 隐式转换、属性访问、打印）委托给 `@xt_*` 运行时调用。
+数值算术与比较是例外：codegen 内联 double 快路径（`numeric.ts`），需要隐式转换时
+才调用运行时。
 
 ### 运行时
 
-`runtime/xt_runtime.c` 实现字符串、对象、数组、闭包、算术、比较、异常与
-类 Node 的 `console.log` 打印。现在 `xt_alloc` 背后使用非移动标记-清扫回收器
-（显式根、子系统根提供者与保守 C 栈扫描），其内部实现对编译器保持隔离。
+`runtime/` 实现字符串、对象、数组、闭包、算术、比较、异常与类 Node 的
+`console.log` 打印。它按职责拆分为多个编译单元（`xt_values.c`、
+`xt_containers.c`、`xt_stdlib.c`、`xt_builtins.c`、`xt_io.c`、`xt_alloc.c` 等），
+每个单元 `#include` 自己的实现片段（`.inc`），这样文件保持小巧而不改变链接范围。
+`xt_alloc` 背后使用非移动标记-清扫回收器（显式根、子系统根提供者与保守 C 栈扫描），
+其内部实现对编译器保持隔离。
 
 ### llc 的替代
 
@@ -92,13 +97,14 @@ xt_value fn(xt_value env, int32_t argc, xt_value *argv);
 同样覆盖：Windows 下 xbintsc 使用系统 clang 按 MSVC ABI 链接，示例即针对该 ABI 构建。
 参见 `examples/extensions/` 与 `runtime/xt_ext.h` / `runtime/xt_ext.rs`。
 
-## 自举路线
+## 自举
 
-编译器本身使用 TypeScript 编写并输出 IR 文本，`runtime` 已与编译器解耦。后续可
-用 TS 重写运行时，并由 xbintsc 编译自身，逐步达成自举。
+编译器已经能编译自身：`xbintsc build src/cli/main.ts --ext node` 会产出一个可用的
+`xbintsc` 二进制，且从第一代起生成的 IR 就是不动点。CI 会为每个支持的平台构建这些
+二进制并检查不动点。运行时仍使用 C；以后是否用 TS 重写只是可选项，并不是自举的前提。
 
 ## 测试
 
 按模块划分：`tests/lexer`、`tests/parser`、`tests/binder`、`tests/codegen`、
-`tests/driver`、`tests/extensions`、`tests/cli`、`tests/e2e`。e2e 会在存在
-`clang` 时真正编译并运行二进制，否则自动跳过。
+`tests/driver`、`tests/extensions`、`tests/cli`、`tests/e2e`。存在受支持的 clang
+（16+，与 `build` 使用的版本门槛一致）时，e2e 会真正编译并运行二进制，否则自动跳过。

package/doc/zh-CN/implemented.md

@@ -233,7 +233,7 @@ xt_value fn(xt_value thisValue, xt_value env, int32_t argc, xt_value *argv);
 
 - 分配器：`xt_alloc` 背后的非移动标记-清扫回收器（显式根、子系统根提供者与保守 C 栈扫描）。
 - 值构造：`xt_undefined/xt_null/xt_bool/xt_number/xt_string_new/xt_string_from_cstr`。
-- 字符串：UTF-8 存储、拼接、相等比较、格式化数字转字符串。
+- 字符串：UTF-8 存储、惰性 cons 节点拼接（首次观察时才扁平化，因此循环追加保持线性复杂度）、相等比较、格式化数字转字符串。
 - 类型转换：`xt_truthy`、`xt_to_number`、`xt_to_string`、`xt_typeof`。
 - 算术：`add/sub/mul/div/mod/pow/neg/pos`。
 - 位运算：`and/or/xor/not/shl/shr/ushr`（含 `ToInt32` 语义）。
@@ -247,7 +247,7 @@ xt_value fn(xt_value thisValue, xt_value env, int32_t argc, xt_value *argv);
 - 运算符辅助：`xt_in`（`in`）、`xt_delete`（`delete`）、`xt_rest_args`（剩余参数 / `arguments`）。
 - Box：`box_new/get/set`（用于闭包捕获变量）。
 - 函数与闭包：`arg`、`closure_new/call/env/arity`。
-- 异常：`xt_try_enter` / `xt_try_exception` / `xt_try_leave` 维护 `_setjmp` 帧栈；`xt_throw` 在存在帧时长跳到最近 `try`，否则打印 `Uncaught ...` 后退出。
+- 异常：`xt_try_enter` / `xt_try_exception` / `xt_try_leave` 维护 `_setjmp` 帧栈；`xt_throw` 在存在帧时长跳到最近 `try`，否则打印 `Uncaught ...` 后退出。codegen 还会维护一条影子调用栈（函数名、源文件、行号）：`Error.stack` 用它生成堆栈，原生崩溃时致命信号处理器也会打印同一组帧。`--debug` 还会生成 `!DICompileUnit` / `!DISubprogram` / `!DILocation` 元数据，并用 `-g -fno-omit-frame-pointer` 编译，因此 gdb/lldb/WinDbg 可以把指令映射回源码行。
 - 输出：`xt_print/xt_println/xt_console_log/info/warn/error`（Node 风格 inspect：数组 `[ a, b ]`、对象 `{ k: v }`；`info`/`log` 到 stdout，`warn`/`error` 到 stderr），以及 `dir/trace/assert/count/countReset/group/groupEnd/table/time/timeEnd/timeLog`。
 - 对象 / 函数：`xt_object` 带原型链，`xt_function` 带属性包（静态成员与 `prototype`）；`xt_new`（实例化）、`xt_instance_of`（原型链）、`xt_object_freeze/is_frozen/from_entries`。
 - 标准库扩展（`xt_stdlib2.c`）：数组 / 字符串 / 数字 / 对象的扩展方法；`Object` / `Array` / `Number` / `String` 静态方法；`JSON.parse` / `JSON.stringify`；`Map` / `Set`；`Date`（`gmtime_r`）；`RegExp`（POSIX ERE `regcomp`/`regexec` 的 `test`/`exec`）。
@@ -338,7 +338,7 @@ const result = build("program.ts", { emit: "exe", outDir: "build" });
 实现位置：`tests/`（`lexer` / `parser` / `binder` / `codegen` / `driver` / `extensions` / `cli` / `e2e`）
 
 - 各模块单元测试；e2e 在存在 `clang` 时真正编译并运行二进制，否则自动跳过。
-- e2e 覆盖：算术与打印、递归函数、循环 / 数组 / 字符串拼接、闭包按引用捕获、对象 / 数组 JS 风格打印、Node `fs` 扩展（经 `import`）、`switch` 穿透、数组 / 字符串方法、`Math` 与全局函数与 `console` 各等级、默认 / 剩余参数与 `arguments`、`Object` 助手与展开与 `in`/`delete`、`for...in` 对象键枚举、`try/catch/finally`、可选链、类与 `new`/`this`/`static`/`extends`/`super`/`instanceof`、`async`/`await` 与 `Promise`、`Map`/`Set`/`JSON` 与扩展标准库、`Map`/`Set` 的 `for...of`、数组 `length` 赋值与可迭代展开、多文件 `import`/`export`、类型化数组（元素强制转换、`from`/`of`、迭代与原型方法），以及全局 `fetch`（HTTP GET/POST、请求头、重定向、JSON/文本/二进制响应体与 `TypeError` 拒绝）。
+- e2e 覆盖：算术与打印、递归函数、循环 / 数组 / 字符串拼接、闭包按引用捕获、对象 / 数组 JS 风格打印、Node `fs` 扩展（经 `import`）、`switch` 穿透、数组 / 字符串方法、`Math` 与全局函数与 `console` 各等级、默认 / 剩余参数与 `arguments`、`Object` 助手与展开与 `in`/`delete`、`for...in` 对象键枚举、`try/catch/finally`、可选链、类与 `new`/`this`/`static`/`extends`/`super`/`instanceof`、`async`/`await` 与 `Promise`、`Map`/`Set`/`JSON` 与扩展标准库、`Map`/`Set` 的 `for...of`、数组 `length` 赋值与可迭代展开、多文件 `import`/`export`、类型化数组（元素强制转换、`from`/`of`、迭代与原型方法）、对象 rest 解构与内建 `instanceof`，以及全局 `fetch`（HTTP GET/POST、请求头、重定向、JSON/文本/二进制响应体与 `TypeError` 拒绝）。
 
 ---
 

package/doc/zh-CN/requirements.md

@@ -19,9 +19,18 @@ build/app.ll:382:37: error: '@.str.0' defined with type '[6 x i8]*' but expected
 ```
 
 有类型指针在 LLVM 16 中被移除（[发布说明](https://github.com/llvm/llvm-project/blob/release/15.x/llvm/docs/ReleaseNotes.rst#changes-to-the-llvm-ir)），
-所以请先确认 `clang --version`；系统 clang 较旧时用 `xbintsc_CLANG` 指向新版。
-`xbintsc doctor` 会报告解析到的工具链及其版本。把 IR 拿到别处编译来绕过该限制
-是不受支持的。
+所以 xbintsc 现在**在编译任何东西之前先检查版本**：
+
+- `xbintsc build` / `run` 一旦发现解析到的驱动低于 16 就立即停止，并给出可操作的错误，
+  而不是生成无法编译的 IR。
+- `xbintsc doctor` 会打印 `status : ok` 或 `status : too old`，在工具链无法构建二进制时
+  以非零码退出，脚本和 CI 可以把它当作预检。
+- 搜索时会优先选择 16+ 的 clang：Windows 上即使 `PATH` 里靠前的是旧 clang，
+  也能找到 Visual Studio 自带的 LLVM
+  （`<VS 安装目录>\VC\Tools\Llvm\x64\bin\clang.exe`）。可以用 `xbintsc_CLANG` 覆盖；
+  显式指定的旧版本会得到 "too old" 错误，而不是被静默忽略。
+
+把 IR 拿到别处编译来绕过该限制是不受支持的。
 
 ## 总览
 

package/doc/zh-CN/unimplemented.md

@@ -40,7 +40,8 @@
 
 > 标记模板已实现，含 raw 字符串与 `String.raw`。生成器（`function*`、`yield`、`yield*`）
 > 基于有栈协程实现，支持 `next`/`throw`/`return`、`for...of`、展开与委托；
-> `import.meta` 可解析，但无运行时取值；异步生成器尚未支持。
+> `import.meta` 提供 `url`、`dirname`、`filename`，由正在运行的可执行文件路径解析。
+> `async function*` 现在会以 `UnsupportedFeature` **明确拒绝**，不再静默产出同步生成器。
 
 ### 2.2 解析器不支持
 
@@ -50,7 +51,7 @@
 
 | 运算符 | 现状 | 说明 |
 | --- | --- | --- |
-| `new.target` | ✗ | 未实现 |
+| `new.target` | ✗ | 已解析，但以 `UnsupportedFeature` 明确拒绝（无 `new.target` 语义） |
 | `typeof` / `void` / `in` / `delete` / `instanceof` | ✓ | 映射到运行时辅助函数（`xt_typeof`、`xt_in`、`xt_delete`、`xt_instance_of`） |
 
 ---
@@ -103,7 +104,7 @@
 | `keys` / `values` / `entries` | ~ 返回数组，而非迭代器对象 |
 | `ArrayBuffer` / `DataView` / `.buffer` / `.byteOffset` 语义 | ✗ 无底层缓冲区类型；`.byteOffset` 恒为 0 |
 | `BigInt64Array` / `BigUint64Array` | ✗ 未实现 |
-| `instanceof Uint8Array` | ✗ 全局构造器不是一等公民值，`x instanceof Uint8Array` 会报 `Cannot find name 'Uint8Array'` |
+| `instanceof` 内建构造器 | ✓ `instanceof Array` / `Object` / `Map` / `Set` / `Date` / `RegExp` / `Promise` / `Error` 家族 / 类型化数组都能按名字识别；但构造器本身仍不是一等公民值（`const A = Array` 仍会失败） |
 | 基于 `Buffer` / `ArrayBuffer` 的类型化数组视图 | ✗ 构造器仅能从长度 / 数组样 / 类型化数组复制 |
 
 ---
@@ -137,8 +138,8 @@
 | `arguments` 对象 | ✓（隐式） | ✓ 已实现（箭头函数取的是自身参数，而非外层函数的 `arguments`，与 JS 不同） |
 | `this` 绑定 / 方法调用语义 | ✓ | ✓ 已实现（`this` 作为函数首个 ABI 参数线程化；箭头函数词法继承） |
 | `async` / `await` / Promise | ✓ | ✓ 已实现（同步微任务模型） |
-| `new.target` | ✗ | 未实现 |
-| 生成器 / 迭代器 / `yield` | ✓ 已实现 | `function*`、`yield`、`yield*`、`.next/.throw/.return`；不支持异步生成器 |
+| `new.target` | ✗ | 已解析，但以 `UnsupportedFeature` 明确拒绝（无 `new.target` 语义） |
+| 生成器 / 迭代器 / `yield` | ✓ 已实现 | `function*`、`yield`、`yield*`、`.next/.throw/.return`；异步生成器以 `UnsupportedFeature` 拒绝 |
 | 闭包 `arity` | — | `xt_closure_arity` 恒为 -1，未填充 |
 | `fn.call` / `fn.apply` / `fn.bind` | ✓ | ✓ 已实现（绑定闭包不跟踪部分参数的 `length`） |
 | `fn.name` / `fn.length` | ✓ | ✓ 已实现（从声明 / 赋值 / 属性键推断；绑定函数为 `"bound ..."` 并调整 arity） |
@@ -199,9 +200,9 @@
 | 函数 `arity` / 调用参数个数 | 无参数个数校验；`fn.length` 报告声明的 arity，但调用不做校验 |
 | `async` / `await` | **同步微任务模型**：`await` 在已 settle 的 promise 上同步继续。定时器与套接字仅在程序主体执行完后由事件循环运行，因此无法等待由定时器回调 settle 的 promise |
 | `super` | `super.x` / `super(...)` 取 `this` 原型的原型；单级继承正确，继承深度 > 1 时可能不准确 |
-| `Error.stack` | 未捕获 |
+| `Error.stack` | 仅函数级帧：每帧为 `at 名称 (文件:行)`，行号取自函数声明（最内层帧会更新为错误构造处）；没有列号，生成器函数体不产生帧（它们会切换栈） |
 | 模块实时绑定 | 命名空间导入与导入绑定为快照（见第 4 节） |
-| `import.meta` | 可解析但无取值 |
+| `import.meta` | ✓ `import.meta.url` / `.dirname` / `.filename`，由可执行文件路径解析 |
 
 > 数字格式化、宽松相等、`+` / 关系运算 `ToPrimitive`、整链可选链、`finally` 提前退出、对象键顺序等均已对齐 Node，并由差分测试覆盖，故不再列为偏差。
 
@@ -227,9 +228,9 @@
 ```
 未实现（语句）：namespace/module 声明
 
-未实现（表达式）：new.target、import.meta 取值
+未实现（表达式）：new.target（会给出明确的 UnsupportedFeature）
 
-未实现（函数）：`fn.toString()` 源码文本、异步生成器
+未实现（函数）：`fn.toString()` 源码文本、异步生成器（已明确拒绝）
 
 未实现（类/面向对象）：abstract/implements、访问控制、父子类 #x 同名
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xbintsc",
-  "version": "0.3.81",
+  "version": "0.3.87",
   "description": "xbintsc - a TypeScript binary compiler (TypeScript -> LLVM IR -> native binary)",
   "type": "module",
   "license": "MIT",
@@ -41,6 +41,8 @@
     "runtime:clean": "node -e \"require('fs').rmSync('build/runtime-obj',{recursive:true,force:true});require('fs').rmSync('runtime/lib',{recursive:true,force:true})\"",
     "xbintsc": "tsx src/cli/main.ts",
     "typecheck": "tsc -p tsconfig.json --noEmit",
+    "check:version": "tsx scripts/check-version.ts",
+    "bench": "tsx scripts/bench.ts",
     "lint": "eslint . && tsx scripts/check-file-length.ts",
     "test": "vitest run",
     "test:watch": "vitest",

package/runtime/ext_node/buffer/parts/construction.inc

@@ -25,7 +25,7 @@ static xt_value xt_buffer_from(xt_value value, const char *encoding) {
   xt_value text = xt_to_string(value);
   xt_string *string = xt_as_string(text);
   size_t decoded = 0;
-  unsigned char *bytes = xt_node_decode(string->data, string->length, encoding, &decoded);
+  unsigned char *bytes = xt_node_decode(xt_string_bytes(string), string->length, encoding, &decoded);
   if (!bytes) return xt_buffer_new(0, NULL);
   xt_value result = xt_buffer_from_bytes(bytes, decoded);
   free(bytes);
@@ -49,7 +49,7 @@ static xt_value xt_buffer_alloc(uint32_t size, xt_value fill, const char *encodi
   xt_value text = xt_to_string(fill);
   xt_string *string = xt_as_string(text);
   size_t decoded = 0;
-  unsigned char *bytes = xt_node_decode(string->data, string->length, encoding, &decoded);
+  unsigned char *bytes = xt_node_decode(xt_string_bytes(string), string->length, encoding, &decoded);
   if (!bytes || decoded == 0) {
     free(bytes);
     return buffer;

package/runtime/ext_node/buffer/parts/methods.inc

@@ -93,7 +93,7 @@ static xt_value xt_buffer_method_write(xt_value thisValue, xt_value env, int32_t
   uint32_t offset = argc > 1 ? (uint32_t)xt_to_number(argv[1]) : 0;
   const char *encoding = argc > 3 ? xt_node_encoding(argv[3]) : NULL;
   size_t decoded = 0;
-  unsigned char *bytes = xt_node_decode(string->data, string->length, encoding, &decoded);
+  unsigned char *bytes = xt_node_decode(xt_string_bytes(string), string->length, encoding, &decoded);
   uint32_t available = xt_buffer_length(thisValue);
   uint32_t written = 0;
   for (size_t i = 0; i < decoded && offset + written < available; i++) {

package/runtime/ext_node/buffer/parts/search.inc

@@ -19,7 +19,7 @@ static const unsigned char *xt_buffer_search_needle(xt_value value, const char *
   xt_value text = xt_to_string(value);
   xt_string *string = xt_as_string(text);
   size_t decoded = 0;
-  unsigned char *bytes = xt_node_decode(string->data, string->length, encoding, &decoded);
+  unsigned char *bytes = xt_node_decode(xt_string_bytes(string), string->length, encoding, &decoded);
   *length = decoded;
   return bytes;
 }

package/runtime/ext_node/child_process/child_process.c

@@ -82,6 +82,27 @@ static char *read_temp(FILE *file) {
   return buffer;
 }
 
+/*
+ * MSVC's `_spawnvp` builds the child command line from argv without quoting
+ * argv[0]. When the executable path contains a space — the default install
+ * location is "C:\Program Files\…" — the child sees the path split into several
+ * arguments ("Files\Microsoft", "Visual", …). Quote argv[0] ourselves. Returns
+ * NULL when no quoting is needed (the caller keeps the original pointer).
+ */
+static char *quote_argv0(char **child_argv) {
+  const char *arg = child_argv[0];
+  if (arg == NULL || strchr(arg, ' ') == NULL) return NULL;
+  size_t length = strlen(arg);
+  char *quoted = (char *)malloc(length + 3);
+  if (!quoted) return NULL;
+  quoted[0] = '"';
+  memcpy(quoted + 1, arg, length);
+  quoted[length + 1] = '"';
+  quoted[length + 2] = 0;
+  child_argv[0] = quoted;
+  return quoted;
+}
+
 xt_value xt_child_process_spawn_sync(int32_t argc, xt_value *argv) {
   const char *command = argc > 0 ? xt_string_data(xt_to_string(argv[0])) : NULL;
   if (!command) command = "";
@@ -91,6 +112,7 @@ xt_value xt_child_process_spawn_sync(int32_t argc, xt_value *argv) {
   int count = 0;
   char **child_argv = (char **)build_argv(command, args, &count);
   if (!child_argv) return make_result(-1, "", "out of memory");
+  char *quoted_command = quote_argv0(child_argv);
 
   char previous[4096];
   int had_cwd = cwd && _getcwd(previous, sizeof(previous)) != NULL;
@@ -99,6 +121,7 @@ xt_value xt_child_process_spawn_sync(int32_t argc, xt_value *argv) {
     if (cwd) _chdir(cwd);
     intptr_t inherit_rc = _spawnvp(_P_WAIT, command, (const char *const *)child_argv);
     if (had_cwd) _chdir(previous);
+    free(quoted_command);
     free(child_argv);
     return make_result(inherit_rc < 0 ? -1 : (double)inherit_rc, "", "");
   }
@@ -106,6 +129,7 @@ xt_value xt_child_process_spawn_sync(int32_t argc, xt_value *argv) {
   FILE *out_file = tmpfile();
   FILE *err_file = tmpfile();
   if (!out_file || !err_file) {
+    free(quoted_command);
     free(child_argv);
     if (out_file) fclose(out_file);
     if (err_file) fclose(err_file);
@@ -136,6 +160,7 @@ xt_value xt_child_process_spawn_sync(int32_t argc, xt_value *argv) {
   char *err = read_temp(err_file);
   fclose(out_file);
   fclose(err_file);
+  free(quoted_command);
   free(child_argv);
 
   xt_value result = make_result(rc < 0 ? -1 : (double)rc, out, err);

package/runtime/ext_node/fs/fd_ops.c

@@ -76,7 +76,7 @@ static unsigned char *xt_fs_value_bytes(xt_value value, size_t *outLength) {
     *outLength = 0;
     return NULL;
   }
-  if (length > 0) memcpy(bytes, string->data, length);
+  if (length > 0) memcpy(bytes, xt_string_bytes(string), length);
   *outLength = length;
   return bytes;
 }

package/runtime/rt.h

@@ -92,7 +92,9 @@ xt_value xt_bool(int b);
 xt_value xt_number(double d);
 xt_value xt_string_new(const char *data, size_t len);
 xt_value xt_string_from_cstr(const char *data);
-/** Raw UTF-8 bytes of a string value (NULL for non-strings); not NUL-safe. */
+/** Raw UTF-8 bytes of a string value (NULL for non-strings); not NUL-safe.
+ * Materialises a lazily concatenated string, so the returned pointer is stable
+ * until the string is collected. */
 const char *xt_string_data(xt_value value);
 int32_t xt_string_length_value(xt_value value);
 
@@ -119,6 +121,8 @@ xt_value xt_function_set_metadata(xt_value fn, xt_value name, int32_t arity);
 xt_value xt_this(void);
 xt_value xt_new(xt_value ctor, int32_t argc, xt_value *argv);
 xt_value xt_instance_of(xt_value value, xt_value ctor);
+/** `value instanceof <built-in constructor>`; id from `BUILTIN_INSTANCEOF`. */
+xt_value xt_instance_of_builtin(xt_value value, int32_t id);
 xt_value xt_function_set_prototype(xt_value fn, xt_value proto);
 xt_value xt_function_get_prototype(xt_value fn);
 
@@ -177,6 +181,8 @@ xt_value xt_object_values(xt_value obj);
 xt_value xt_object_entries(xt_value obj);
 xt_value xt_object_assign(int32_t argc, xt_value *argv);
 xt_value xt_object_spread(xt_value target, xt_value source);
+/** Own enumerable properties of `source` except the keys in `argv` (object rest). */
+xt_value xt_object_rest(xt_value source, int32_t argc, xt_value *argv);
 
 /* -- symbols -------------------------------------------------------------- */
 /** Implements `Symbol(description)`. */
@@ -340,6 +346,16 @@ void xt_throw(xt_value v);
 void *xt_try_enter(void);
 xt_value xt_try_exception(void *frame);
 void xt_try_leave(void *frame);
+/**
+ * JavaScript-level shadow stack. Generated code pushes `(name, file, line)` on
+ * function entry and pops before returning; `Error` construction walks it to
+ * build `.stack`, and a fatal native signal dumps it. The strings are static
+ * module data, so the runtime never owns them.
+ */
+void xt_stack_push(const char *name, const char *file, int32_t line);
+void xt_stack_pop(void);
+/** Set the innermost frame's line (called just before `new Error(...)`). */
+void xt_stack_set_line(int32_t line);
 void xt_console_log(int32_t argc, xt_value *argv);
 void xt_console_info(int32_t argc, xt_value *argv);
 void xt_console_warn(int32_t argc, xt_value *argv);

package/runtime/rt_internal.h

@@ -21,8 +21,12 @@
  *    code free of write barriers and makes the first implementation small and
  *    predictable. Replacing it with a precise/conservative collector is an
  *    isolated change behind `xt_alloc` plus root registration.
- *  * Strings are UTF-8. JavaScript measures string length in UTF-16 code
- *    units; `xt_string_length` currently reports code points (see README).
+ *  * Strings are UTF-8. Concatenation is lazy: a `+` between two non-empty
+ *    strings builds an immutable cons node (`flat == NULL`) and the bytes are
+ *    materialised once, on first observation, by `xt_string_bytes`. This keeps
+ *    `s += x` in a loop linear instead of copying the accumulated prefix every
+ *    iteration. JavaScript measures string length in UTF-16 code units;
+ *    `xt_string_length` currently reports code points (see README).
  *  * Objects use a small linear property list. Fine for the language subset
  *    xbintsc targets today; swap for a hash map when the profile demands it.
  */
@@ -64,11 +68,19 @@ typedef struct xt_header {
 
 #define XT_GC_MARK 0x01u
 
-typedef struct {
+/* A string is either *flat* (`flat` points at `capacity` bytes, the last one
+ * NUL) or a *cons* node (`flat == NULL`, `left`/`right` name the operands).
+ * `length` is always the total byte length, so `.length`, comparisons and the
+ * GC never need to force a cons node. `xt_string_bytes` turns a cons node into
+ * a flat one in place; treat the result as immutable and never write through a
+ * pointer obtained from it. */
+typedef struct xt_string {
   xt_header header;
   uint32_t length;
   uint32_t capacity;
-  char *data;
+  char *flat;
+  struct xt_string *left;
+  struct xt_string *right;
 } xt_string;
 
 /* Sign-magnitude arbitrary-precision integer; see xt_bigint.c. */
@@ -99,6 +111,10 @@ typedef struct {
   uint8_t frozen;
   uint8_t is_array_base;
   uint16_t reserved2;
+  /* Captured `Error.stack` for XT_OBJECT_KIND_ERROR, XT_UNDEFINED otherwise.
+   * Deliberately not a property: `Object.keys`, `for...in` and JSON.stringify
+   * must not see it, while `error.stack` returns it through `xt_get`. */
+  xt_value error_stack;
 } xt_object;
 
 typedef struct {
@@ -191,6 +207,12 @@ xt_string *xt_string_alloc(size_t length);
 xt_string *xt_as_string(xt_value value);
 int32_t xt_string_length(xt_string *s);
 int xt_string_equals(xt_string *a, xt_string *b);
+/* Contiguous UTF-8 bytes of a string, flattening a cons node in place on first
+ * use. The result is NUL-terminated at `s->length`; never write through it. */
+const char *xt_string_bytes(xt_string *s);
+/* Mutable bytes of a string just created with `xt_string_alloc` (never a cons
+ * node). Used by the constructors that fill a buffer before publishing it. */
+char *xt_string_mutable(xt_string *s);
 int32_t xt_to_int32(xt_value v);
 
 /* ECMAScript number formatting (xt_values.c). */
@@ -284,6 +306,10 @@ typedef struct xt_try_frame {
   jmp_buf buf;
   struct xt_try_frame *prev;
   xt_value exception;
+  /* Shadow-stack depth when the protected region was entered; restored when
+   * the region is left (normally or through a throw) so frames from unwound
+   * calls do not leak into later stack traces. */
+  int32_t stack_depth;
 } xt_try_frame;
 /* Save a try frame with clang's `_setjmp` built-in.
  *
@@ -300,6 +326,23 @@ typedef struct xt_try_frame {
 void *xt_try_mark(void);
 void xt_try_restore(void *mark);
 
+/* -- shadow call stack and diagnostics (xt_io/exception.inc) --------------- */
+/* Generated code pushes a frame on entry and pops it before returning, so an
+ * Error can capture a JavaScript-level stack without any debug metadata. Frame
+ * strings live in the module's static data and are never freed. */
+void xt_stack_push(const char *name, const char *file, int32_t line);
+void xt_stack_pop(void);
+int32_t xt_stack_depth(void);
+void xt_stack_set_line(int32_t line);
+/* Restore the depth saved by a try frame after unwinding inner calls. */
+void xt_stack_trim(int32_t depth);
+/* Format `Name: message` plus the current frames as an `Error.stack` string. */
+xt_value xt_stack_capture(const char *name, const char *message);
+/* The captured stack of an error object, or XT_UNDEFINED. */
+xt_value xt_error_stack(xt_value error);
+/* Best-effort stack dump on a fatal native signal / unhandled exception. */
+void xt_install_crash_handler(void);
+
 /* -- collection / date / regexp representations --------------------------- */
 typedef struct {
   xt_header header;

package/runtime/xt_alloc.c

@@ -210,6 +210,9 @@ void xt_gc_init(void) {
       g_gc_threshold_pinned = 1;
     }
   }
+  /* A crash is the one case where the JavaScript-level shadow stack is the
+   * most useful thing to print; install the handler once per process. */
+  xt_install_crash_handler();
 }
 
 void xt_gc_arm(void) { g_gc_armed = 1; }
@@ -328,7 +331,16 @@ static void xt_gc_process(xt_header *header) {
   const void *base = (const char *)header + sizeof(xt_header);
 
   switch (header->kind) {
-    case XT_OBJECT_KIND_STRING:
+    case XT_OBJECT_KIND_STRING: {
+      /* A flat string holds bytes only. A cons node is an immutable rope whose
+       * children must stay alive until `xt_string_bytes` materialises it. */
+      xt_string *string = (xt_string *)header;
+      if (string->flat == NULL) {
+        if (string->left) xt_gc_gray_push(&string->left->header);
+        if (string->right) xt_gc_gray_push(&string->right->header);
+      }
+      return;
+    }
     case XT_OBJECT_KIND_BIGINT:
     case XT_OBJECT_KIND_DATE:
       /* Numbers/bytes only: no references to follow. */
@@ -392,7 +404,7 @@ static void xt_gc_process(xt_header *header) {
 static void xt_gc_release(xt_header *header) {
   switch (header->kind) {
     case XT_OBJECT_KIND_STRING:
-      free(((xt_string *)header)->data);
+      free(((xt_string *)header)->flat);
       break;
     case XT_OBJECT_KIND_BIGINT:
       free(((xt_bigint *)header)->limbs);

package/runtime/xt_bigint/conversions.inc

@@ -41,7 +41,7 @@ static xt_value bi_from_xt_value(xt_value value) {
   if (XT_IS_NUMBER(value)) return xt_bigint_from_double(xt_to_double(value));
   if (XT_IS_STRING(value)) {
     xt_string *s = xt_as_string(value);
-    return xt_bigint_from_string(s->data, s->length);
+    return xt_bigint_from_string(xt_string_bytes(s), s->length);
   }
   if (value == XT_TRUE) return xt_bigint_from_i64(1);
   if (value == XT_FALSE) return xt_bigint_from_i64(0);