feat(runtime): write runtime diagnostics to stderr

Runtime check messages and the unhandled-exception message were printed
to stdout by the generated program, so `cpsc x.cps -r >out.txt` captured
them. They are now formatted with snprintf and written with write(2).
Test expectations and docs are updated accordingly.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

5 files changed, 7 insertions, 7 deletions

diff --git a/AGENTS/ARCH.md b/AGENTS/ARCH.md
index aef89ed..5ddddc1 100644
--- a/AGENTS/ARCH.md
+++ b/AGENTS/ARCH.md
@@ -75,9 +75,9 @@ Generated IR uses the C++ exception ABI; native compilation links its runtime
 automatically. Manually linking emitted `.ll` files still requires a C++ driver
 (use LLVM 23's `clang++`, or `clang++-23` on Debian/Ubuntu).
 TRY/CATCH/ENDTRY and bare THROW are compiler extensions.
-Runtime checks print the source line and error reason to stdout before throwing
+Runtime checks print the source line and error reason to stderr before throwing
 anonymous exceptions; the final handler in generated main
-prints `Unhandled exception. Program terminated.` to stdout and returns 1.
+prints `Unhandled exception. Program terminated.` to stderr and returns 1.
 Exception execution with the embedded ORC JIT is verified on Linux with LLVM 23;
 Windows/macOS await CI verification.
 
diff --git a/AGENTS/CONVENTIONS.md b/AGENTS/CONVENTIONS.md
index 2686760..f912e79 100644
--- a/AGENTS/CONVENTIONS.md
+++ b/AGENTS/CONVENTIONS.md
@@ -176,9 +176,9 @@ Its handler stack and catch depth are keyed by LLVM function, so synthesizing fi
 helpers never inherits the caller's catches. User calls, file runtime calls and
 THROW must use `ExceptionHandler::emitCall`; ordinary nonthrowing libc calls stay
 plain calls. RETURN must finish all active catches after evaluating its value.
-`RuntimeCheck::emitCheck` prints the source line and error reason to stdout before
+`RuntimeCheck::emitCheck` prints the source line and error reason to stderr before
 throwing. Generated main catches anything unhandled, prints the generic termination
-message to stdout, and returns 1. Explicit bare THROW prints no diagnostic itself.
+message to stderr, and returns 1. Explicit bare THROW prints no diagnostic itself.
 Arrays in TRY and CATCH use separate block scopes; scalars retain existing function scope.
 
 **Compilation units and entry points.** SourceUnit borrows its AST list; it and the
diff --git a/AGENTS/EXTENDING.md b/AGENTS/EXTENDING.md
index b3f481a..3161407 100644
--- a/AGENTS/EXTENDING.md
+++ b/AGENTS/EXTENDING.md
@@ -62,7 +62,7 @@ collapse to a legacy node.
 **New runtime check:** add `emitXxxCheck` in `RuntimeCheck` (build an i1
 fail-condition and call `emitCheck` with a diagnostic format and arguments — it
 splits the block and leaves the builder at the continuation), then call it from
-the emit site. Failure prints the source line and error reason to stdout before
+the emit site. Failure prints the source line and error reason to stderr before
 throwing an anonymous exception; generated main supplies the uncaught message
 and status 1. Precedents: `emitIndexCheck`, `emitEnumRangeCheck`, `emitNullDerefCheck`,
 `emitArrayArgBoundsCheck` and FileHandler's direct `emitCheck` calls.
diff --git a/AGENTS/PITFALLS.md b/AGENTS/PITFALLS.md
index d811ea4..951a2f6 100644
--- a/AGENTS/PITFALLS.md
+++ b/AGENTS/PITFALLS.md
@@ -121,7 +121,7 @@ test programs.
   ENDTRY. Bare THROW raises a new anonymous exception even inside CATCH; there is
   no rethrow syntax, error object or what(). Runtime checks are catchable;
   compiler errors are not. Runtime checks print the source line and error reason
-  to stdout before throwing, even when caught. Uncaught exceptions also print the
+  to stderr before throwing, even when caught. Uncaught exceptions also print the
   generic termination message and return 1. Bare THROW prints no diagnostic itself.
   Native binaries must link the C++ runtime with LLVM 23's `clang++`
   (`clang++-23` on Debian/Ubuntu).
diff --git a/AGENTS/SUBSYSTEMS.md b/AGENTS/SUBSYSTEMS.md
index d21dfe8..bb59ebf 100644
--- a/AGENTS/SUBSYSTEMS.md
+++ b/AGENTS/SUBSYSTEMS.md
@@ -114,7 +114,7 @@ dereferences and array-parameter bounds contracts are checked at their emit site
 `ArithmeticHandler` calls `emitDivZeroCheck` before `/`, DIV and MOD; the check accepts
 integer and floating-point divisors, including both floating-point signed zeros.
 `emitCheck(Cond, Msg, Args)` splits the block, prints the source line and error
-reason to stdout, and calls `ExceptionHandler::emitThrow` on failure. File helper
+reason to stderr, and calls `ExceptionHandler::emitThrow` on failure. File helper
 checks receive the source line as a runtime argument.
 
 **Exceptions** (`ExceptionHandler`): holds Context/Builder/Module refs and a map of