js-on-sx: global eval(src) actually evaluates the source

Was returning the input unchanged: eval('1+2') gave "1+2".
Per spec, eval(string) parses and evaluates as JS; non-string
passes through. Wired through js-eval (existing
lex/parse/transpile/eval pipeline).
built-ins/String fail count 13 → 11. conformance.sh: 148/148.

plans/js-on-sx.md

@@ -158,6 +158,8 @@ Each item: implement → tests → update progress. Mark `[x]` when tests green.
 
 Append-only record of completed iterations. Loop writes one line per iteration: date, what was done, test count delta.
 
+- 2026-05-08 — **Global `eval(src)` actually evaluates the source.** Was returning the input string unchanged: `eval('1+2')` returned `"1+2"`, not `3`. Per spec, `eval(string)` parses and evaluates as JS; non-string input passes through. Wired the runtime stub through `js-eval` (which already does the lex/parse/transpile/eval pipeline) when the arg is a string. Fixes `String(eval('var x'))`, the harness internal `eval(...)`, and any test that calls `eval` for runtime evaluation. built-ins/String fail count: 13 → 11. conformance.sh: 148/148.
+
 - 2026-05-08 — **`new <non-callable>` throws TypeError instead of hanging.** `new (new Object(""))` (calling `new` on a String wrapper dict) hung because `js-new-call` called `js-get-ctor-proto` which fell through to `js-ctor-id` which called `inspect ctor` — and `inspect` on a wrapper-with-proto-chain recurses through the prototype's lambdas forever. Added a `(js-function? ctor)` precheck at the top of `js-new-call`: when the receiver isn't callable, raise a `TypeError` instance instead. Now `try { new x } catch(e) { e instanceof TypeError }` returns `true` for non-callable `x`. conformance.sh: 148/148. String 80/99, Array 23/45 maintained.
 
 - 2026-05-08 — **JS functions accept extra args silently (per spec).** SX strictly arity-checks: `(fn (a) ...)` rejects 2 args, but JS allows passing more args than declared (the extras are accessible via `arguments`). Was raising `f expects 1 args, got 2` whenever Array.from passed `(value, index)` to a 1-arg mapFn, etc. Fixed in `js-build-param-list` (transpile.sx): every JS function param list now ends with `&rest __extra_args__` (unless an explicit rest param is already present), so extras are silently absorbed. Headline scoreboards unchanged but unblocks a class of harness-mediated failures. conformance.sh: 148/148.