Recover from malformed file-backed Objective-C roots

[lynnswap]

Purpose

File-backed Objective-C root tables are external metadata. The previous dependency path narrowed raw 64-bit section coordinates through existential getters and used trapping table reads, so malformed or truncated metadata could terminate the helper or disappear without a diagnostic. This change makes the file-mode root boundary structurally checked while leaving loaded RW-extension arrays, loaded image info, and referenced C strings outside this scope.

Changes

• Pin MachOObjCSection to 8f0ff76f02c0865422a72662177b5e687e43522d, which adds an additive ObjCFileRootReadResult, validates typed 32/64-bit section and segment coordinates, reuses the shared table budgets, preserves good/bad/good entry order, and resolves ordinary files and cache subfiles through the checked logical-offset owner. Existing root properties remain source-compatible projections of the checked reads.
• Pin MachOSwiftSection to the coherent dependency cohort at 06ed57ab39fc24956f9079beeb407fffa30d50f4.
• Read file-backed roots through readRoots() in PrivateHeaderKit and route their typed failures through the existing bounded Objective-C diagnostic cap, deduplication, wire report, and persistence path.
• Add a synthetic Mach-O fixture that isolates a malformed 64-bit class-list pointer table and verifies the file-root owner and degradation text, plus update the documented structural safety boundary.

Review focus

• Nonempty file roots require consistent raw section/segment mapping; legal empty roots succeed before unused coordinate or backing validation.
• Cache roots keep a main-cache-relative logical offset while physical reads map to the owning subcache, and diagnostics retain the canonical logical offset.
• One malformed root section or entry is recoverable without reordering or discarding readable sibling roots, and no parallel diagnostic budget or report format is introduced.

Testing

• MachOObjCSection: 124 focused iOS and watchOS 27 drop canonicalized Objective-C protocol conformances #60/Resolve all loaded entries in Objective-C relative method and property lists #65/Objective-C metadata reads can still terminate iOS 27 helpers with FileIO.offsetOutOfBounds #79/Unchecked Objective-C table and loaded-image reads can still trap on malformed metadata #83/File-backed Objective-C root sections bypass checked coordinates and table reads #88 tests passed; Debug/Release and iOS/watchOS cross-builds passed; independent audit and codex-review found no issue.
• MachOSwiftSection: six ObjC-ancestor tests and the Release product build passed; codex-review found no issue.
• PrivateHeaderKit: focused malformed-root test passed; full Swift 6.3.2 suite passed with 625 tests; macOS Release build, Swift 6.3.2 iOS/watchOS Core and test cross-builds, both simulator-helper Release cross-builds, release-script contract tests, exact-pin tests, independent audit, and final branch-wide codex-review passed.
• iOS 27.0 beta 24A5390f cache probe: TrialProto's nonempty __objc_classlist was read from subcache .01 as 226 classes with zero diagnostics; the logical-to-physical subcache offset matched the existing cache owner.

Closes #88

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.

[lynnswap]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 309be879f0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[lynnswap]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: 309be879f0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".