fix infinite loop in shop

docs/spec/objects.md

@@ -26,7 +26,7 @@ Every heap-allocated object begins with a 64-bit header word (`objhdr_t`):
 
 ### Flags (bits 3-7)
 
-- **Bit 3 (S)** — Stone flag. If set, the object is immutable and excluded from GC.
+- **Bit 3 (S)** — Stone flag. If set, the object is immutable. Stone text in the constant table (ct) is not copied by GC since it lives outside the heap; stone objects on the GC heap are copied normally.
 - **Bit 4 (P)** — Properties flag.
 - **Bit 5 (A)** — Array flag.
 - **Bit 7 (R)** — Reserved.
@@ -69,7 +69,9 @@ struct JSText {
 };
 ```
 
-Text is stored as UTF-32, with two 32-bit codepoints packed per 64-bit word. When a text object is stoned, the length field is repurposed to cache the hash value (computed via `fash64`), since stoned text is immutable and the hash never changes.
+Text is stored as UTF-32, with two 32-bit codepoints packed per 64-bit word.
+
+A mutable text (pretext) uses capacity for the allocated slot count and length for the current codepoint count. When a pretext is stoned, the capacity field is set to the actual length (codepoint count), and the length field is zeroed for use as a lazy hash cache (computed via `fash64` on first use as a key). Since stoned text is immutable, the hash never changes. Stoning is done in-place — no new allocation is needed.
 
 ## Record
 
@@ -111,7 +113,7 @@ struct JSFrame {
   objhdr_t header;     // type=6, capacity=slot count
   JSValue function;    // owning function
   JSValue caller;      // parent frame
-  uint32_t return_pc;  // return address
+  JSValue address;     // return address
   JSValue slots[];     // [this][args][captured][locals][temps]
 };
 ```
@@ -138,4 +140,4 @@ All objects are aligned to 8 bytes. The total size in bytes for each type:
 | Record | `8 + 8 + 8 + (capacity + 1) * 16` |
 | Function | `sizeof(JSFunction)` (fixed) |
 | Code | `sizeof(JSFunctionBytecode)` (fixed) |
-| Frame | `8 + 8 + 8 + 4 + capacity * 8` |
+| Frame | `8 + 8 + 8 + 8 + capacity * 8` |