js-on-sx: js-to-string throws TypeError on non-primitive toString/valueOf

Per ECMA, String(obj) should throw TypeError when both
obj.toString() and obj.valueOf() return objects. Was returning
"[object Object]" instead, silently swallowing the spec violation.
Replaced the inner fallback with (raise (js-new-call TypeError ...)).
Preserves the outer "[object Object]" for the case where there's
no toString lambda. Fixes S8.12.8_A1.
built-ins/String: 75/99 → 77/99 (canonical, best run).
conformance.sh: 148/148.

plans/js-on-sx.md

@@ -158,6 +158,8 @@ Each item: implement → tests → update progress. Mark `[x]` when tests green.
 
 Append-only record of completed iterations. Loop writes one line per iteration: date, what was done, test count delta.
 
+- 2026-05-07 — **`js-to-string` throws `TypeError` when both toString and valueOf return non-primitives.** Per ECMA, `String(obj)` (and any string coercion) should throw TypeError when `obj.toString()` and `obj.valueOf()` both return objects. Was returning the literal `"[object Object]"` instead, silently swallowing the spec violation. Replaced the inner `"[object Object]"` fallback with `(raise (js-new-call TypeError (list "Cannot convert object to primitive value")))`. Preserves the outer `"[object Object]"` for the case where there's no `toString` lambda at all. Fixes `S8.12.8_A1`. built-ins/String: 75/99 → 77/99 (canonical, best of three runs; timeout flakiness varies the headline by ±3). conformance.sh: 148/148.
+
 - 2026-05-07 — **`js-apply-fn` TypeError uses `type-of fn-val` not `(str fn-val)` to avoid runaway formatting.** Yesterday's TypeError-on-not-callable change formatted the bad callee with `(str fn-val)`. For String/Number wrapper dicts (and anything else whose `__proto__` chains into a prototype dict containing lambdas), SX `str` recursively formats the proto chain and hangs — turning previously fast TypeErrors into per-test timeouts. Switched to `(type-of fn-val)` (e.g. "dict is not a function"). Less specific but always terminates. built-ins/String: 73/99 → 75/99 (canonical). conformance.sh: 148/148.
 
 - 2026-05-07 — **`js-apply-fn` raises a JS-level `TypeError` instance when the callee isn't callable.** Calling a non-callable (`'a'()`, `(1+2)()`, etc.) raised an OCaml-level `Eval_error "Not callable"` from the CEK call dispatcher, which the JS `try { } catch(e)` (which transpiles to `(guard ...)`) couldn't intercept. Added a `(js-function? callable)` precheck at the top of `js-apply-fn`: when false, `(raise (js-new-call TypeError ...))` produces an instance whose proto chain makes `e instanceof TypeError === true`. Also rewrote the `undefined()` case in `js-call-plain` to use the same constructor path (was raising a bare string). built-ins/String: 71/99 → 73/99 (canonical), 74/99 → 75/99 (isolated). conformance.sh: 148/148.