fix: 对齐 Number 原型四方法规范序位并补齐绑定元数据面

crates/oxide_kernel/src/builtin/construct.rs

@@ -75,6 +75,18 @@ pub(crate) fn make_named_pair(
     make_pair(string_forge, shape_forge, name, labels.prototype, labels.constructor, labels.name)
 }
 
+/// 把 Number.prototype 标成 Number 对象本体：规范 21.7.3 规定其是
+/// [[NumberData]] = +0 的 Number object。type_tag 是 Object.prototype.toString
+/// 品牌表的判据（置位后报 "[object Number]"），boxed 值供 thisNumberValue/
+/// valueOf 的通用分支读取。
+pub(crate) fn tag_number_proto(proto: &P<JsObject>) {
+    let ptr = proto.as_ptr() as *mut JsObject;
+    // SAFETY: proto 是 make_named_pair 刚建的本进程对象，P 引用与裸指针同址。
+    let obj = unsafe { &mut *ptr };
+    obj.type_tag = JsObject::OBJ_TYPE_NUMBER_OBJ;
+    obj.set_boxed_value(JsValue::int(0));
+}
+
 pub(crate) fn make_error_subtypes(error_proto: &P<JsObject>) -> ErrorSubtypeProtos {
     let error_proto_val = JsValue::from_js_object(error_proto.as_ptr() as *mut JsObject);
     ErrorSubtypeProtos {
@@ -436,6 +448,7 @@ impl BuiltinWorld {
         let (function_proto, function_constructor) = make_named_pair(string_forge, shape_forge, labels, "Function");
         let (string_proto, string_constructor) = make_named_pair(string_forge, shape_forge, labels, "String");
         let (number_proto, number_constructor) = make_named_pair(string_forge, shape_forge, labels, "Number");
+        tag_number_proto(&number_proto);
         let (boolean_proto, boolean_constructor) = make_named_pair(string_forge, shape_forge, labels, "Boolean");
         let (error_proto, error_constructor) = make_named_pair(string_forge, shape_forge, labels, "Error");
         let (symbol_proto, symbol_constructor) = make_named_pair(string_forge, shape_forge, labels, "Symbol");

crates/oxide_kernel/src/builtin/rebuild.rs

@@ -7,8 +7,8 @@ use oxide_types::object::JsObject;
 use oxide_types::value::JsValue;
 
 use super::construct::{
-    builtin_labels, make_error_subtypes, make_named_pair, make_typed_array_family, wire_builtin_world_links,
-    ErrorSubtypeProtos, TypedArrayFamily,
+    builtin_labels, make_error_subtypes, make_named_pair, make_typed_array_family, tag_number_proto,
+    wire_builtin_world_links, ErrorSubtypeProtos, TypedArrayFamily,
 };
 use super::BuiltinWorld;
 use crate::kernel::BuiltinDirtySet;
@@ -183,7 +183,11 @@ impl BuiltinWorld {
             (current.string_proto.clone(), current.string_constructor.clone())
         };
         let (number_proto, number_constructor) = if dirty.number {
-            make_named_pair(string_forge, shape_forge, labels, "Number")
+            // 脏重建与全量构造同形：原型本体须带 Number 对象 tag 与 +0 包值，
+            // 漏此分支 full_reset 后 tag 翻回 "Object"。
+            let (proto, ctor) = make_named_pair(string_forge, shape_forge, labels, "Number");
+            tag_number_proto(&proto);
+            (proto, ctor)
         } else {
             (current.number_proto.clone(), current.number_constructor.clone())
         };