…on plan

Plan operationalizes the spec into 18 tasks across 3 phases:
- Phase 1 (Tasks 1-3): infrastructure — fixture base class, BaselineEmitter,
  PublicMemberScanner + coverage framework
- Phase 2 (Tasks 4-15): reference Suite (Type/Struct) end-to-end, then 11
  per-subdirectory migrations following the same template
- Phase 3 (Tasks 16-18): coverage invariant guard, baseline-generator CLI
  polish, final validation + CLAUDE.md docs

Uses dispatcher pattern in BaselineGenerator from Task 4 so per-subdirectory
tasks just append one case + one call. Each task ends with idempotent
generator run and `swift test --filter`.

…der string interpolation

Per user direction, baseline files are now produced via SwiftSyntaxBuilder's
string-interpolation form (SourceFileSyntax + \(literal:) / \(raw:)) instead
of plain string concatenation:
- SwiftSyntax parse-validates the generated source at construction time
  (malformed Swift fails immediately, before write to disk).
- .formatted() normalizes indent/whitespace so re-runs are byte-identical.
- \(literal:) handles String/Int/Bool/[String]/Optional escaping natively.
BaselineEmitter shrinks to two helpers (hex/hexArray) since that's the only
case \(literal:) doesn't natively cover (Int defaults to decimal).

…lopen fixture loader

Loads SymbolTestsCore.framework from disk, dlopens it once into the test
process, and exposes machOFile/machOImage plus three ReadingContext
instances (fileContext/imageContext/inProcessContext). Adds smoke probe
to verify all three readers see the fixture's swift5_types section.

… fix dlopen message API name

…axBuilder dep

Adds two-function helper (hex/hexArray) for emitting integer literals as
hex (`0x...`) for ABI baseline files. Strings/bools/decimal ints/arrays of
strings/optionals are emitted via SwiftSyntaxBuilder's `\(literal:)`
interpolation directly. Hex needs a helper because `\(literal: 0x10)` outputs
`16` (decimal). Wires SwiftSyntaxBuilder into MachOTestingSupport deps.

…eSuite, scanner

PublicMemberScanner walks SwiftSyntax to extract public/open func/var/init from a
source root, keyed by (typeName, memberName). Skips internal/private/fileprivate,
@_spi(...) on member or any enclosing extension/type, Layout-suffixed types, and
@MemberwiseInit-synthesized init(layout:offset:). FixtureSuite protocol exposes
testedTypeName + registeredTestMethodNames for the Coverage Invariant test
wiring up later.

PublicMemberScanner now collects public/open subscripts as MethodKey
`subscript(<labels>:)`, mirroring the init handling. Codebase has public
subscripts (FullMetadata, ContextDescriptorProtocol, TypeLayout) that the
Coverage Invariant test in Task 16 will require coverage for.

…Struct

Reference implementation locking the pattern reused by remaining Models/
subdirectories: per-file BaselineGenerator (MachOFile path) writes a literal
__Baseline__/<File>Baseline.swift, and per-file Tests Suite asserts both
cross-reader equality (file/image/inProcess + ReadingContext variants) and
baseline literal equality. Picks Structs.StructTest + GenericStructNonRequirement
as fixture variants.

Fixes 5 issues raised in code review:
- Add Scripts/regen-baselines.sh wrapping the DYLD env-var setup;
  baseline headers now point at it.
- Hoist load helper in StructTests to dedupe 9x construction blocks.
- Replace hard-coded 8 in StructMetadataTests.descriptorOffset with
  MemoryLayout<UnsafeRawPointer>.size for arch-correct assertion.
- Document @mainactor cascade on FixtureSuite for Task 16's invariant test.
- Document presence-flag rationale + Suite inclusion rule.

…e/Extension

Cover Anonymous/Module/Extension context wrappers and descriptors via the
SymbolTestsCore fixture. Anonymous and Extension context descriptors don't
appear in __swift5_types directly, so the picker discovers them by walking
the parent chain of every type descriptor; the Module picker selects the
SymbolTestsCore module the same way and disambiguates by name. Each public
member gets a @test with cross-reader equality and a baseline literal,
following the Task 4 pilot pattern.

Adds contextDescriptors: [ContextDescriptorWrapper] to
SwiftSectionRepresentable so the picker can filter by kind generically over
both MachOFile and MachOImage. Empty protocols
(Module/ExtensionContextDescriptorProtocol) are intentionally not given
Suites — they declare no public members.

…sionContextDescriptor + self-contained AnonymousContextDescriptorProtocol baseline

- Move extendedContext from ExtensionContextDescriptorBaseline to a new
  ExtensionContextDescriptorProtocolBaseline + Suite (the scanner attributes
  protocol-extension methods to the extended protocol, not to the file's
  type).
- Add Entry to AnonymousContextDescriptorProtocolBaseline so the Suite no
  longer reads from AnonymousContextDescriptorFlagsBaseline.
- Document the protocol-extension attribution rule in BaselineGenerator.swift
  for Tasks 6-15.

Adds 9 Suites covering every testable file in
Sources/MachOSwiftSection/Models/ContextDescriptor/:

- ContextDescriptorTests (offset, layout)
- ContextDescriptorFlagsTests (rawValue, init, kind, version, kindSpecific*,
  hasInvertibleProtocols, isUnique, isGeneric)
- ContextDescriptorKindTests (description, mangledType)
- ContextDescriptorKindSpecificFlagsTests (protocolFlags, typeFlags,
  anonymousFlags)
- ContextDescriptorProtocolTests (parent, genericContext,
  moduleContextDesciptor, isCImportedContextDescriptor,
  subscript(dynamicMember:))
- ContextDescriptorWrapperTests (5 case-extractors, 9 is* predicates,
  4 alternate-projection vars, parent, genericContext, resolve)
- ContextProtocolTests (parent)
- ContextWrapperTests (context, forContextDescriptorWrapper, parent)
- NamedContextDescriptorProtocolTests (name, mangledName)

48 @tests across 9 Suites. Protocol-extension methods (on
ContextDescriptorProtocol / ContextProtocol /
NamedContextDescriptorProtocol) live in their own Suites per the
attribution rule, NOT in concrete-descriptor Suites.

ContextDescriptorWrapper exercises only the Structs.StructTest variant
(isStruct: true); broader kind coverage is deferred to the dedicated
concrete-kind Suites in Tasks 7-11. *Layout files are skipped per scanner
rules.

Adds Suites for the 25-file `Models/Type/Class/` group covering Class
core, Method/, Metadata/ (AnyClassMetadata, AnyClassMetadataObjCInterop,
Bounds, ClassMetadata, ClassMetadataObjCInterop), and Resilient/.

- 22 sub-generators in `Sources/MachOTestingSupport/Baseline/Generators/Class/`
  (nested for readability since the Class group is much larger than Tasks
  4-6 — switching from flat naming used previously).
- 22 Suites in `Tests/MachOSwiftSectionTests/Fixtures/Type/Class/`,
  mirroring source layout (`Method/`, `Metadata/AnyClassMetadata/`, etc.).
- 3 new pickers in `BaselineFixturePicker`: `class_ClassTest`,
  `class_SubclassTest`, `class_ObjCInteropTest`.
- 95 @tests; all pass.

Notes:
- `ClassMetadataProtocol`/`ClassMetadataObjCInteropProtocol` are empty
  marker protocols (no public func/var/init), so no Suite is emitted.
- `MethodDescriptorWrapper` (macro-generated public surface) and
  `MethodImplementationPointer` (raw enum cases only) have no scannable
  public members — no Suite emitted.
- `MethodDefaultOverrideDescriptor`/`MethodDefaultOverrideTableHeader`/
  `ObjCResilientClassStubInfo`/`ObjCClassWrapperMetadata` carry no live
  fixture instance under SymbolTestsCore; their Suites register member
  surface only and document the missing runtime coverage.
- `StoredClassMetadataBoundsTests.layout` is MachOImage-only because the
  resilient bounds pointer crosses into SymbolTestsHelper (which the
  MachOFile reader cannot follow); the asymmetry is documented in the
  Suite docstring.

…d picker

- ClassDescriptorTests now uses loadClassTestDescriptors()/loadSubclassTestDescriptors()
  helpers, deduping ~13 identical setup blocks.
- Remove class_ObjCInteropTest picker (currently unused; re-add alongside its
  Suite when ObjC-interop fixture lands).

Adds 6 fixture-based Suites and corresponding baseline generators for
the Type/Enum/ source group, mirroring the Type/Class/ layout from
Task 7. Sub-generators live under Generators/Enum/ for readability.

New picker functions for the SymbolTestsCore enum fixtures:
- enum_NoPayloadEnumTest (4 empty cases)
- enum_SinglePayloadEnumTest (1 payload + 2 empty)
- enum_MultiPayloadEnumTest (3 payloads + 1 empty)
- multiPayloadEnumDescriptor_MultiPayloadEnumTest (resolves the
  __swift5_mpenum entry by walking the mangled-name lookup elements
  to find a relative reference matching the EnumDescriptor's offset,
  since Swift's identifier substitution makes plain string matching
  unreliable for the bare type name)

Coverage: 44 new @tests across 6 Suites, ~36 MethodKeys after
overload deduplication. EnumMetadata and EnumMetadataProtocol use
the asymmetric reader pattern (live metadata only via MachOImage
accessor) consistent with the Struct/Class metadata Suites.

Adds 10 fixture-based Suites and corresponding baseline generators for
the `Type/` root source group, mirroring the layout conventions from
Tasks 7-8. Sub-generators live under `Generators/Type/` for readability.

Suites cover:
- TypeContextDescriptor (offset/layout + 3 kind-projection methods)
- TypeContextDescriptorFlags (16-bit FlagSet, struct + class pickers)
- TypeContextDescriptorProtocol (protocol-extension methods)
- TypeContextDescriptorWrapper (3-case sum type, projections + resolve)
- ValueTypeDescriptorWrapper (2-case sibling enum in same source file —
  scanner attributes its members to a separate MethodKey namespace)
- TypeContextWrapper (high-level Enum/Struct/Class context wrapper)
- TypeMetadataRecord (raw __swift5_types record, walked from the section)
- TypeReference (4-case sum type, forKind/resolve)
- ValueMetadata (registered-only — accessor reachable via MachOImage)
- ValueMetadataProtocol (registered-only — protocol-extension)

`TypeReferenceKind` is a pure enum (cases only, no public funcs/vars)
and is skipped per the standard scanner-visibility rule.

Removes the legacy `TypeContextDescriptorFlagsTests.swift` at the test
target root (one trivial test) — it was superseded by the comprehensive
fixture-based Suite under `Fixtures/Type/`, and its identical basename
collided with the new file under SwiftPM's flat .o naming.

Coverage: 63 new @tests across 11 Suites (the 10 listed plus the
ValueTypeDescriptorWrapper companion). Idempotent baseline regen
verified byte-identical on a second run.

Implements Task 10 of the fixture-test plan: fixture-based Suites for the
17 testable files under `Sources/MachOSwiftSection/Models/Protocol/` plus
its `Invertible/` and `ObjC/` subdirectories. Adds 4 protocol pickers
(`protocol_ProtocolTest`, `protocol_ProtocolWitnessTableTest`,
`protocol_BaseProtocolTest`, `protocolRecord_first` MachOFile/MachOImage
overloads, `protocolConformance_resilientWitnessFirst`,
`objcProtocolPrefix_first`) that surface live fixture entities for the
new generators.

Each Suite tracks the file's full public surface via the auto-emitted
`registeredTestMethodNames` and exercises every accessor across MachO +
MachOImage readers (and the ReadingContext overloads where they avoid
the in-process Symbols-table walk that destabilizes the current test
runner).

Skipped per the rules: pure-data enums (`ProtocolClassConstraint`,
`ProtocolDispatchStrategy`, `SpecialProtocolKind`,
`Invertible/InvertibleProtocolKind`), the empty marker
`ProtocolDescriptorProtocol`, the `*Layout` types, and
`ProtocolDescriptorWithObjCInterop` (no source-level public methods —
the `@AssociatedValue`/`@CaseCheckable` macro expansions aren't visible
to PublicMemberScanner). `RelativeObjCProtocolPrefix` lacks a live
fixture carrier, so the Suite registers its public surface for
Coverage Invariant tracking.

…ance/

Implements Task 11 of the fixture-test plan: fixture-based Suites for
the 4 testable files under `Sources/MachOSwiftSection/Models/ProtocolConformance/`
(`ProtocolConformance`, `ProtocolConformanceDescriptor`, `ProtocolConformanceFlags`,
`GlobalActorReference`).

Adds three new pickers to `BaselineFixturePicker` that surface live fixture
entities for the new generators:

  - `protocolConformance_StructTestProtocolTest` — primary fixture
    (`Structs.StructTest: Protocols.ProtocolTest`), the simplest path:
    non-retroactive, no global-actor isolation, no resilient witnesses,
    no conditional requirements. Identifies the conformance via
    (conforming-type-descriptor name, protocol-descriptor name) since
    both names are unique within the fixture.
  - `protocolConformance_conditionalFirst` — first conformance whose
    `numConditionalRequirements > 0`, sourced from the
    `ConditionalConformanceVariants.ConditionalContainerTest` extensions.
  - `protocolConformance_globalActorFirst` — first conformance with
    `hasGlobalActorIsolation` set, sourced from
    `Actors.GlobalActorIsolatedConformanceTest: @mainactor ...`.

Each Suite tracks the file's full public surface via the auto-emitted
`registeredTestMethodNames` and exercises every accessor across MachO +
MachOImage readers (and the ReadingContext overloads where applicable).

Sub-generators live under `Generators/ProtocolConformance/` per the
4+-files convention from prior tasks (Type/Class/, Type/Enum/, Type/,
Protocol/).

Note: regenerating the baselines required a clean rebuild of the
SymbolTestsCore fixture binary so the new global-actor-isolated
conformance types from `Actors.swift` would surface in `__swift5_proto`.
The rebuild shifts every offset in the binary, which propagates to
all existing `__Baseline__/*Baseline.swift` literals.

Adds 16 fixture-based Suites covering Sources/MachOSwiftSection/Models/Generic/.
The Suites and their generated baselines exercise the principal branches of the
generic-context parser:

  - GenericContextDescriptorFlags / GenericRequirementFlags / GenericEnvironmentFlags
    flag types: synthetic raw values per option-bit combination.
  - GenericContextDescriptorHeader / TypeGenericContextDescriptorHeader: header
    layouts read from the first generic extension and from the
    GenericStructLayoutRequirement type, respectively.
  - TargetGenericContext (the underlying struct of GenericContext / TypeGenericContext
    typealiases): five fixture variants — non-requirement, layout requirement,
    Swift-protocol requirement, parameter pack, and invertible-protocol — covering
    parameters, requirements, typePacks, conditional invertible protocols, parent
    chains, and the "current/all" derived projections.
  - GenericParamDescriptor / GenericPackShapeDescriptor / GenericPackShapeHeader:
    descriptor-level scalar fields read from the layout-requirement and parameter-
    pack fixtures.
  - GenericRequirementDescriptor / GenericRequirement: per-kind descriptors and
    high-level wrappers across layout / Swift-protocol / ObjC-protocol / baseClass /
    sameType branches.
  - GenericRequirementContent.InvertedProtocols: stored fields read from the
    InvertibleProtocolRequirementTest fixture.
  - GenericValueDescriptor / GenericValueHeader / GenericWitnessTable /
    GenericEnvironment: registration-only Suites — SymbolTestsCore does not
    surface live carriers for these (no integer-value generics, runtime-only
    structures), so the Suites document the missing coverage and register the
    public surface for the Coverage Invariant test.

Pure-data files with no public methods (GenericContextDescriptorHeaderProtocol,
GenericPackKind, GenericParamKind, GenericRequirementKind,
GenericRequirementLayoutKind, GenericValueType, TypeGenericContext) are skipped
per the FixtureSuite inclusion rule. Adds seven new fixture pickers
(struct_GenericStructLayoutRequirement, _SwiftProtocolRequirement,
_ObjCProtocolRequirement, _SameTypeRequirementTest, _ParameterPackRequirementTest,
_InvertibleProtocolRequirementTest, _BaseClassRequirementTest) and a new
Generators/Generic/ subdirectory mirroring the layout convention from
Tasks 7-11.

Baselines are byte-identical across regen runs (idempotent).

…/FieldRecord/AssociatedType

Adds 6 fixture-based Suites + baselines covering:
- FieldDescriptor (FieldDescriptorKind skipped — pure enum, no public members)
- FieldRecord, FieldRecordFlags
- AssociatedType, AssociatedTypeDescriptor, AssociatedTypeRecord

New picker: associatedTypeDescriptor_ConcreteWitnessTest — resolves the
AssociatedTypeDescriptor for AssociatedTypeWitnessPatterns.ConcreteWitnessTest
(5 concrete witnesses) by walking conformingTypeName lookup elements back
to the matching StructDescriptor offset.

Renames the legacy DyldCache-based AssociatedTypeTests.swift to
DyldCacheAssociatedTypeTests.swift to avoid SwiftPM filename collision
with the new fixture Suite (matches the legacy test's actual scope —
exploratory dyld-cache walking, not structural assertions).

Run via:
  swift test --filter "FieldDescriptor|FieldRecord|AssociatedType"

…. Headers + Initialization)

Adds 23 baseline generators and 23 fixture-based Suites covering
`Sources/MachOSwiftSection/Models/Metadata/` (core, Headers/, MetadataInitialization/).

Coverage:
- Core (15): CanonicalSpecializedMetadata{AccessorsListEntry,sCachingOnceToken,
  sListCount,sListEntry}, FixedArrayTypeMetadata, FullMetadata, Metadata,
  MetadataAccessorFunction, MetadataBounds, MetadataBoundsProtocol,
  MetadataProtocol, MetadataRequest, MetadataResponse, MetadataWrapper,
  MetatypeMetadata, SingletonMetadataPointer.
- Headers/ (5): HeapMetadataHeader, HeapMetadataHeaderPrefix,
  TypeMetadataHeader, TypeMetadataHeaderBase, TypeMetadataLayoutPrefix.
- MetadataInitialization/ (2): ForeignMetadataInitialization,
  SingletonMetadataInitialization.

Skipped (no public func/var/init or empty marker protocols):
MetadataKind, MetadataState, HeapMetadataProtocol,
HeapMetadataHeaderPrefixProtocol, HeapMetadataHeaderProtocol,
TypeMetadataHeaderBaseProtocol, TypeMetadataHeaderProtocol,
TypeMetadataLayoutPrefixProtocol — PublicMemberScanner emits no MethodKey
entries.

Reader-asymmetry pattern documented per Suite: most metadata types are
reachable only through MachOImage's accessor invocation, so the
cross-reader equality block compares image vs imageContext (and
in-process where applicable) rather than the standard MachOFile triple.
For types not surfaced anywhere in the SymbolTestsCore fixture
(CanonicalSpecialized*, FixedArrayTypeMetadata, MetatypeMetadata,
SingletonMetadataPointer, ForeignMetadataInitialization), the Suite
asserts structural members behave correctly against synthetic memberwise
instances.

Adds picker `class_singletonMetadataInitFirst` to discover the first
ClassDescriptor in the fixture carrying the
`hasSingletonMetadataInitialization` bit (the only descriptor shape that
materialises a live SingletonMetadataInitialization payload from the
fixture).

The SingletonMetadataInitialization baseline encodes RelativeOffset
(Int32) values as UInt64 bitPatterns because BaselineEmitter.hex sign-
extends to UInt64 and negative Int32 values overflow a signed Int64
literal; the Suite recovers via Int32(truncatingIfNeeded:).

All 90+ new test cases pass; baselines are byte-stable across regen
runs; existing Suites unaffected.

…ries

Cover the 10 testable Models/ subdirectories from Task 15's plan:
  - ExistentialType (7 Suites: ExistentialMetatypeMetadata, ExistentialTypeFlags,
    ExistentialTypeMetadata, ExtendedExistentialTypeMetadata, ExtendedExistentialTypeShape,
    ExtendedExistentialTypeShapeFlags, NonUniqueExtendedExistentialTypeShape)
  - TupleType (2 Suites: TupleTypeMetadata + TupleTypeMetadata.Element nested)
  - OpaqueType (4 Suites: OpaqueMetadata, OpaqueType, OpaqueTypeDescriptor,
    OpaqueTypeDescriptorProtocol)
  - BuiltinType (2 Suites: BuiltinType, BuiltinTypeDescriptor)
  - ForeignType (2 Suites: ForeignClassMetadata, ForeignReferenceTypeMetadata)
  - Function (2 Suites: FunctionTypeFlags, FunctionTypeMetadata)
  - Heap (2 Suites: GenericBoxHeapMetadata, HeapLocalVariableMetadata)
  - DispatchClass (1 Suite: DispatchClassMetadata)
  - ValueWitnessTable (3 Suites: TypeLayout, ValueWitnessFlags, ValueWitnessTable)
  - Mangling (1 Suite: MangledName; MangledNameKind has no public surface)

Total 26 Suites, 112 tests.

Capture/ and Misc/ skipped per plan (Capture files are empty placeholders;
SpecialPointerAuthDiscriminators uses package-scoped declarations only).

New picker: builtinTypeDescriptor_first (first record from __swift5_builtin).

Live carriers used where reachable (BuiltinTypeDescriptor, MangledName,
ValueWitnessTable via Structs.StructTest's metadata accessor). Synthetic
memberwise instances used for runtime-only metadata kinds (ExistentialTypeMetadata,
TupleTypeMetadata, FunctionTypeMetadata, GenericBoxHeapMetadata,
HeapLocalVariableMetadata, DispatchClassMetadata, ForeignClassMetadata,
ForeignReferenceTypeMetadata, ExtendedExistentialTypeMetadata,
ExtendedExistentialTypeShape, NonUniqueExtendedExistentialTypeShape) and
for OpaqueType/OpaqueTypeDescriptor (SymbolTestsCore's opaque-type
descriptors don't surface via swift.contextDescriptors or via parent
chains on the current toolchain — documented in the picker source).

OpaqueTypeFixtureTests is named distinctly to avoid a collision with the
pre-existing OpaqueTypeTests protocol mixin at the test target root.

ExistentialTypeFlags / FunctionTypeFlags baselines restrict raw values to
ones that don't trip force-unwrap traps in their accessors (documented
in the baseline source).

Adds AsyncParsableCommand-based CLI to baseline-generator. --suite restricts
regeneration to one Suite (e.g. `Scripts/regen-baselines.sh --suite StructDescriptor`),
--output overrides the default Tests/MachOSwiftSectionTests/Fixtures/__Baseline__.

Static SwiftSyntax scan of Sources/MachOSwiftSection/Models/ produces the
expected (typeName, memberName) set; reflection over allFixtureSuites
produces the registered set. missing/extra are both required to be empty.
CoverageAllowlistEntries collects intentional exclusions with reasons.

Two scanner refinements landed alongside:
- Layout skip narrowed from hasSuffix("Layout") to == "Layout" so that
  top-level types like TypeLayout (real public API) are no longer filtered.
- Backtick-quoted identifiers (e.g. `Protocol`, `protocol`) now strip
  backticks before MethodKey emission so they align with Suite registration
  strings.

BaselineGenerator now emits __Baseline__/AllFixtureSuites.swift as part
of generateAll (a single hand-maintained suite-name list, sorted at emit
time). 1 allowlist entry: ProtocolDescriptorRef.init(storage:) — the test
reaches the synthesized memberwise init via @testable import; no public
init declaration exists for the scanner to find.

Verified by adding a probe public func, observing the test fail, then
reverting and observing PASS.

…ule narrowing

Task 16's scanner refinement narrowed the Layout skip rule from
hasSuffix("Layout") to == "Layout" so that top-level types like TypeLayout
(real public API) are no longer filtered. The pre-existing PublicMemberScannerTests.skipsLayoutTypes
case still asserted against a SampleLayout-suffixed top-level fixture, which
the scanner now correctly DOES include — making the test fail.

Update the fixture to use a nested Layout struct (mirroring the actual
descriptor convention the rule exists to handle) and update the assertion
to key on `MethodKey("Layout", "offset")`.

baseline-generator (and any other non-test consumer) used to transitively
link Testing.framework / _Testing_AppKit / etc. via MachOTestingSupport,
producing macOS deployment-target mismatch warnings on every executable
build.

Only five base classes (DyldCacheTests, MachOFileTests, MachOImageTests,
XcodeMachOFileTests, MachOSwiftSectionFixtureTests) genuinely import
Testing. Everything else — Baseline/, Coverage/, fixture loaders, name
enums, helpers — moves to a new MachOFixtureSupport target with no
Testing dependency. baseline-generator now depends on MachOFixtureSupport
directly so its link line no longer drags Testing dylibs in. Test
targets gain a MachOFixtureSupport dependency to keep accessing the
moved symbols.

Also drops a stale, never-used SnapshotTesting dependency carried over
from the original MachOTestingSupport target.

…utput

Phase A3 follow-up. After applying the four-assertion CoverageInvariant
gate to the existing A2 seeded sentinel set, two real misalignments
surfaced. This commit fixes both, plus a scanner blind spot uncovered
in the process.

  Scanner enhancement (SuiteBehaviorScanner.swift)

    The body-only marker check from the prior commit still missed real
    tests where a private helper (e.g. loadStructTestMetadata()) is the
    only place the reader is referenced. Add a class-scope fallback:
    when a @test func body has no marker, inspect the enclosing class
    body and inherit `.acrossAllReaders` if any reader marker shows up
    there. This catches the helper-call indirection without
    over-classifying genuinely synthetic suites (their entire class body
    is reader-free). New scanner test detectsHelperReaderAsAcrossAllReaders
    plus a HelperReaderTests sample suite document the contract.

  29 liars removed from sentinel groups

    A2 wrongly tagged these as sentinel even though their @test funcs
    actually call acrossAllReaders / use machOImage:

      pureDataUtility    ContextDescriptorFlags (6),
                         AnonymousContextDescriptorFlags (2),
                         MethodDescriptorFlags (5),
                         ProtocolContextDescriptorFlags (2),
                         ProtocolRequirementFlags (3),
                         TypeContextDescriptorFlags (3)
      runtimeOnly        AnyClassMetadataObjCInteropProtocol.superclass,
                         ExistentialTypeMetadata.{protocols,superclassConstraint},
                         MetadataProtocol.kind,
                         MetadataResponse.state,
                         TupleTypeMetadata.elements
      needsFixtureExtension  ResilientSuperclass.{layout,offset}

  Sentinel groups extended for unmarked methods

    Public methods on synthetic-memberwise / pure-bitfield types whose
    suite bodies don't touch a reader. Extended existing groups across
    all three categories rather than introducing new ones; added four
    fresh groups (EnumTagCounts pureDataUtility; OpaqueType,
    OpaqueTypeDescriptor, OpaqueTypeDescriptorProtocol all
    needsFixtureExtension because opaque-type descriptors aren't
    reachable through swift.contextDescriptors on the current
    toolchain).

Both gates (③ liarSentinel + ④ unmarkedSentinel) now report empty.

…iant assertions

Phase A3 of fixture-coverage tightening. Tightens
MachOSwiftSectionCoverageInvariantTests with two new assertions backed
by SuiteBehaviorScanner (per-method @test behavior introspection):

  ③ liarSentinel — fails if a sentinel-tagged key's Suite actually
    calls acrossAllReaders / inProcessContext. Catches stale tags
    after a sentinel suite is upgraded to a real test.

  ④ unmarkedSentinel — fails if a Suite has sentinel behavior (no
    acrossAllReaders / inProcessContext call) but the key isn't
    declared sentinel in CoverageAllowlistEntries. Closes the
    silent-sentinel loophole found in PR #85 review.

The PR's 88 existing sentinel suites are tagged in A2; this commit
just wires the gates. Phase B and Phase C remove sentinel entries as
suites are converted to real tests.

…Process real tests

Phase C2 of fixture-coverage tightening. Converts 5 sentinel-only
suites covering stdlib runtime-allocated metadata:
  - MetatypeMetadata (type(of: Int.self))
  - TupleTypeMetadata, TupleTypeMetadataElement ((Int, String).self)
  - FunctionTypeMetadata, FunctionTypeFlags (((Int) -> Void).self)

Each suite now uses usingInProcessOnly + InProcessMetadataPicker
constants and asserts against ABI literals pinned in regenerated
baselines. Removed corresponding entries from CoverageAllowlistEntries
runtimeOnly group.

Also fixes InProcessMetadataPicker.stdlibIntMetatype (introduced in
C1): Swift folds T.self.self to T.self, so the original definition
yielded the underlying type's metadata (kind 0x200) instead of the
metatype metadata (kind 0x304). Switched to type(of: Int.self).

Coverage details:
  - MetatypeMetadata.layout/offset: cross-validates kind=0x304 and
    instanceType pointer == Int.self bit pattern.
  - TupleTypeMetadata.layout/offset/elements: kind=0x301,
    numberOfElements=2, labels=null, element count matches.
  - Element.type/offset: first element type pointer == Int.self,
    offset=0x0.
  - FunctionTypeMetadata.layout/offset: kind=0x302,
    flags.rawValue=0x4000001 (1 param + escaping bit).
  - FunctionTypeFlags.numberOfParameters: anchored against
    ((Int) -> Void).self runtime metadata.

The plan's verbatim suite code registered names like 'kind' and
'instanceType' under wrapper typeNames (e.g., MetatypeMetadata.kind),
but PublicMemberScanner attributes those to the protocol-extension
typeName (MetadataProtocol). Adapted the suites to use the
scanner-visible names ('layout', 'offset', 'elements', 'type') with
the layout-subfield assertions inside the test bodies. This keeps
CoverageInvariant green (no spurious extra/missing keys) while
delivering equivalent ABI-literal coverage.

CoverageAllowlistEntries diff:
  - TupleTypeMetadata: ['init', 'kind', 'numberOfElements', 'labels'] -> ['init']
  - Element: ['init', 'type', 'offset'] -> ['init']
  - FunctionTypeMetadata: ['init', 'kind', 'flags', 'result', 'parameters', 'parameterFlags', 'layout', 'offset'] -> ['init']
  - MetatypeMetadata: ['init', 'kind', 'instanceType', 'layout', 'offset'] -> ['init']
  - FunctionTypeFlags: dropped 'numberOfParameters' (now real test);
    added 'init(rawValue:)' to fix a pre-existing scanner mismatch
    (allowlist had bare 'init' which doesn't equal 'init(rawValue:)').

…ss real tests

Phase C3 of fixture-coverage tightening. Converts 6 sentinel-only suites
covering stdlib runtime-allocated existential metadata:
  - ExistentialTypeMetadata (Any.self + AnyObject.self)
  - ExistentialMetatypeMetadata (Any.Type.self)
  - ExistentialTypeFlags (flags slice of Any/AnyObject)
  - ExtendedExistentialTypeMetadata ((any Sequence<Int>).self)
  - ExtendedExistentialTypeShape (shape pointer of (any Sequence<Int>))
  - ExtendedExistentialTypeShapeFlags (shape flags slice)

Each suite now uses usingInProcessOnly + InProcessMetadataPicker
constants and asserts against ABI literals pinned in regenerated
baselines. Removed corresponding entries from CoverageAllowlistEntries
runtimeOnly + pureDataUtility groups.

NonUniqueExtendedExistentialTypeShape stays sentinel: the non-unique
form is only emitted statically by the compiler before runtime
deduplication; runtime metadata always points at the unique form, so
it's not reachable via InProcessMetadataPicker. SymbolTestsCore doesn't
currently emit a non-unique shape statically either. Allowlist entry
narrowed from {init, uniqueShape, specializedShape, existentialType,
layout, offset} to {existentialType, layout, offset} (matching actual
source declarations) and the sentinel reason updated to explain the
non-reachability.

InProcessMetadataPicker additions:
  - stdlibAnyObjectExistential (AnyObject.self): class-bounded
    existential with zero witness tables (flags 0x0). Required because
    Any.self's flags (0x80000000) trap the source's
    UInt8(rawValue & 0x80000000) accessor when reading classConstraint.
  - stdlibAnyEquatable repurposed to (any Sequence<Int>).self
    (parameterized-protocol existential with kind 0x307). The plan's
    original choice (any Equatable) gives kind 0x303 because Equatable
    isn't parameterized; only protocols with primary associated types
    yield extendedExistential metadata. Constant name retained for plan
    continuity. Guarded with @available(macOS 13.0+) since
    parameterized-protocol existentials require macOS 13.0+ runtime.

Test deviations from the plan's verbatim:
  - Test names match the wrapper's directly-declared scanner-visible
    properties (layout, offset, isClassBounded, isObjC, representation,
    superclassConstraint, protocols, existentialType) rather than the
    A3-allowlist-listed names which include stale entries that don't
    exist in source (e.g. isClassConstrained, isErrorExistential,
    typeExpression, suggestedValueWitnesses, uniqueShape,
    specializedShape, genericArguments, kind, instanceType, flags).
    The A3 allowlist members didn't reflect the actual source surface.
  - Two metadata sources (Any + AnyObject) are needed for
    ExistentialTypeMetadata / ExistentialTypeFlags because Any.self's
    flags trap on classConstraint.
  - ExtendedExistentialTypeMetadata.layout asserts shape pointer is
    non-zero rather than pinning a literal address — the runtime
    allocates the shape lazily, so its address is non-deterministic
    across process invocations.
  - ExtendedExistentialTypeShape.offset asserts non-zero for the same
    reason.
  - ExtendedExistentialTypeShape.existentialType asserts the resolved
    MangledName is non-empty (mangled-name strings depend on Swift
    runtime's exact encoding for parameterized protocols).
  - Extended shape tests use `guard #available(macOS 13.0+) else
    { return }` rather than annotating the @suite class because
    @suite + @available is rejected by swift-testing.

Coverage details:
  - ExistentialTypeMetadata.layout: kind=0x303, flags=0x80000000 for Any
    or 0x0 for AnyObject, numberOfProtocols=0.
  - ExistentialTypeMetadata.{isClassBounded,isObjC,representation}:
    AnyObject decodes to .class / true / .class.
  - ExistentialTypeMetadata.{superclassConstraint,protocols}: short-
    circuit on Any (no superclass / zero protocols).
  - ExistentialMetatypeMetadata.layout: kind=0x306, instanceType points
    to Any.self, flags=0x80000000.
  - ExtendedExistentialTypeMetadata.layout: kind=0x307, shape non-null.
  - ExtendedExistentialTypeShape.layout: flags=0x1900 (the runtime's
    bitset for (any Sequence<Int>)), requirementSignatureNumParams=2
    (Self + the primary associated type).
  - ExtendedExistentialTypeShapeFlags: rawValue=0x1900, round-trip via
    init(rawValue:).

CoverageAllowlistEntries diff:
  - ExistentialTypeMetadata: removed (was: stale members, now real test)
  - ExistentialMetatypeMetadata: removed
  - ExtendedExistentialTypeMetadata: removed
  - ExtendedExistentialTypeShape: removed
  - ExistentialTypeFlags: removed (pureDataUtility)
  - ExtendedExistentialTypeShapeFlags: removed (pureDataUtility)
  - NonUniqueExtendedExistentialTypeShape: members narrowed to
    {existentialType, layout, offset}, reason updated.

Coverage invariant test passes (4 expectations green); 673
MachOSwiftSection tests pass.

…eal test

Adds `InProcessMetadataPicker.fixtureMetadata(symbol:)` accessor that
dlopens SymbolTestsCore.framework and resolves a metadata accessor
function via dlsym. Invocation goes through the swiftcc-aware C wrapper
(`swift_section_callAccessor0`) since Swift's `@convention(c)` cannot
express a struct-return type matching swiftcc.

Converts `DispatchClassMetadataTests` to a real InProcess test against
`Classes.ClassTest.self`'s runtime metadata pointer, exercising the
wrapper's `layout` and `offset` accessors. No ABI literal is pinned
because the `kind` slot is the descriptor / isa pointer and `offset`
is the runtime metadata pointer bit-pattern — both ASLR-randomized.
The Suite asserts non-zero / `MetadataKind.class`-decoding invariants.

Removes `layout`, `offset` from the DispatchClassMetadata allowlist
entry; the remaining members (`init`, `kind`, `isaPointer`,
`superclass`, `data`, `ivar1`, `flags`) are scanner-attributed via
marker protocols and stay on the allowlist.

Deviation from C4 plan:
- Most listed C4 suites (StructMetadataTests, EnumMetadataTests,
  ClassMetadataTests, AnyClassMetadataTests, ValueMetadataTests,
  StoredClassMetadataBoundsTests) are already real tests using
  `machOImage`-based descriptor.metadataAccessorFunction; no
  conversion needed.
- `ClassMetadataBoundsTests` kept as synthetic round-trip: the type
  has no runtime derivation path from a class metadata pointer
  (only static factories `forSwiftRootClass` /
  `forAddressPointAndSize` and `adjustForSubclass` instance method).
  Allowlist for `ClassMetadataBounds` left unchanged.
- `ClassMetadataObjCInteropTests`, `AnyClassMetadataObjCInteropTests`,
  `ObjCClassWrapperMetadata` left for B3 (ObjCClassWrappers fixture).

Phase C5 — completes Phase C. Converts ~6 metadata-layer suites:
Metadata, FullMetadata, MetadataWrapper, MetadataRequest/Response,
MetadataAccessorFunction, SingletonMetadataPointer, *MetadataHeader,
*Bounds. Each reuses pointers from C2-C4 + offset arithmetic.

Remaining runtimeOnly sentinel: marker protocols (no public extension
methods) and GenericBoxHeapMetadata / HeapLocalVariableMetadata
(cannot construct stably from tests).

Deviation from C5 plan:
- Most listed C5 suites (MetadataTests, FullMetadataTests,
  MetadataWrapperTests, MetadataResponseTests,
  MetadataAccessorFunctionTests, HeapMetadataHeaderTests,
  TypeMetadataHeaderTests) are already real tests using either
  MachOImage descriptor accessors or InProcess metadata pointers; no
  conversion needed.
- Only 4 sentinel suites were genuinely candidates for conversion:
  MetadataRequest, SingletonMetadataPointer, MetadataBounds,
  HeapMetadataHeaderPrefix.
- MetadataRequestTests converted to a real `.inProcessOnly` test:
  the bit-packing assertions are now wrapped in
  `usingInProcessOnly` so the suite is classified as
  `.inProcessOnly` rather than `.sentinel` (the `InProcessContext`
  is unused; the assertions exercise the flag-set bit-packing
  accessors directly). Allowlist entry removed.
- HeapMetadataHeaderPrefixTests converted to a real
  `.acrossAllReaders` test that materialises the prefix at the
  second word of `Classes.ClassTest`'s heap metadata layout
  (offset = `interop.offset - HeapMetadataHeader.layoutSize +
  TypeMetadataLayoutPrefix.layoutSize`). Asserts non-zero offset
  and non-nil destroy pointer. Allowlist trimmed to `init` +
  `destroy` (scanner-attributed via marker protocols).
- SingletonMetadataPointerTests kept sentinel: the trailing payload
  requires a descriptor with the `hasSingletonMetadataPointer` bit,
  not just a runtime metadata pointer; SymbolTestsCore declares no
  such descriptor. Allowlist `detail:` text expanded with rationale.
- MetadataBoundsTests kept sentinel: same rationale as
  ClassMetadataBounds (no runtime derivation path from a class
  metadata pointer; only synthetic memberwise construction).
  Allowlist `detail:` text expanded with rationale.
- Generator headers updated to reference the new
  `swift package regen-baselines` command instead of the legacy
  `Scripts/regen-baselines.sh` wrapper. Re-added missing
  `import MachOFixtureSupport` to AllFixtureSuites.swift generator
  (FixtureSuite protocol now lives in MachOFixtureSupport after
  the recent refactor).

…rs ABI gap

Phase B1 of fixture-coverage tightening — DEFERRED.

The plan assumed @_dynamicReplacement(for:) would surface
MethodDefaultOverrideTable. Investigation against the Swift compiler
(SILGenType.cpp) confirmed the table is only emitted for the new
caller-allocated coroutine accessor evolution feature
(read2/modify2 on a resilient open class), gated behind the
experimental CoroutineAccessors flag. Enabling this flag triggers
references to _swift_deletedCalleeAllocatedCoroutineMethodErrorTwc,
which the macOS Swift runtime does not yet export. Conclusion: the
fixture cannot be built on the current macOS toolchain.

Updates the detail strings for MethodDefaultOverrideDescriptor and
MethodDefaultOverrideTableHeader to record the toolchain gap.
OverrideTableHeader's residual sentinel surface is also reframed
(init is memberwise; numEntries is reached transitively via
layout.numEntries by the existing real Classes.SubclassTest test).

Continuing to B2 (ResilientClasses) which has no toolchain dependency.

Phase B2. SymbolTestsCore.ResilientClassFixtures.ResilientChild
inherits from SymbolTestsHelper.ResilientBase; under -enable-library-
evolution the parent's metadata is resilient and CROSS-MODULE, which
triggers:

  - ResilientSuperclass (descriptor tail record carrying the
    resilient parent reference)
  - StoredClassMetadataBounds (runtime-loaded class metadata bounds
    written by the runtime when the class is realised)

Both suites converted from sentinel to real tests:
  - ResilientSuperclassTests is now real cross-reader (MachOFile +
    MachOImage) against a deterministic class-by-name picker.
  - StoredClassMetadataBoundsTests is InProcess-only — the relative
    pointer crosses module boundaries (the MachOFile/MachOImage
    readers see only SymbolTestsCore), so the canonical path is
    InProcess via dlsym + ClassDescriptor.resilientMetadataBounds.

Allowlist updated; both groups removed entirely. Coverage invariant
remains green; all baselines regenerated for the rebuilt fixture.
ResilientBase moved into SymbolTestsHelper because cross-module is
required to fire hasResilientSuperclass.

Snapshot tests for the new fixture file: resilientClassesSnapshot
under SwiftDump and the interface snapshot's ResilientClassFixtures
section.

…ites

Phase B3. New fixture `ObjCClassWrappers.swift` adds NSObject-derived
classes (`ObjCBridge`) and an `@objc protocol` conformer
(`ObjCBridgeWithProto`) to surface the ObjC-interop metadata shapes:
  - ObjCClassWrapperMetadata (kind 0x305) -- now a real InProcess test
    against `Foundation.NSObject.self` (the canonical carrier; the
    Swift runtime allocates kind-0x305 wrapper metadata for plain ObjC
    classes).
  - ClassMetadataObjCInterop / AnyClassMetadataObjCInterop -- already
    real cross-reader tests against `Classes.ClassTest` since Phase C;
    Phase B3 removes the stale `runtimeOnly` allowlist entries that
    were left over from when the suites were merely registration-only.

`RelativeObjCProtocolPrefix` remains a registration-only sentinel: it
is reached only at runtime through Swift's mangled-name symbolic-
reference resolver (`MetadataReader` opcode .objectiveCProtocol = 0x0e)
when a Swift mangled name embeds an ObjC-protocol symbolic ref. `@objc
protocol`s do not emit Swift-side conformance descriptors, so the
relative prefix variant is unreachable from descriptor traversal in
SymbolTestsCore. The sentinel reason is updated with the diagnosis;
the suite stays registration-only.

Pickers `class_ObjCBridge` / `class_ObjCBridgeWithProto` are added as
documented utility helpers (available for downstream phases).

Snapshot tests added for the new fixture file:
  - SymbolTestsCoreDumpSnapshotTests.objCClassWrappersSnapshot
  - SymbolTestsCoreInterfaceSnapshotTests interfaceSnapshot updated
    inline.

All baselines regenerated to absorb section offset shifts from the new
fixture file (mechanically expected).

…in doesn't emit)

Phase B5 attempted to surface the four canonical-specialized-metadata
records (`CanonicalSpecializedMetadataAccessorsListEntry`,
`CanonicalSpecializedMetadatasCachingOnceToken`,
`CanonicalSpecializedMetadatasListCount`,
`CanonicalSpecializedMetadatasListEntry`) by adding a fixture with
`@_specialize(exported: true, where T == Int)` and
`@_specialize(exported: true, where T == String)` annotations on a
generic function.

Empirical verification: a one-shot enumeration of all
`typeContextDescriptors` in the rebuilt `SymbolTestsCore` framework
showed ZERO descriptors with the
`hasCanonicalMetadataPrespecializations` bit set. The toolchain emits
the specialized SIL functions (`Si_Ts5`, `SS_Ts5` symbol suffixes), but
not the trailing-objects descriptor records.

Root cause: the canonical-specialized-metadata records are emitted only
when the Swift frontend is invoked with `-prespecialize-generic-metadata`,
a flag normally reserved for stdlib builds and gated behind
`OPT_prespecialize_generic_metadata` /
`Opts.PrespecializeGenericMetadata` in
`swift/lib/Frontend/CompilerInvocation.cpp`. Forcing the flag via
`-Xfrontend -prespecialize-generic-metadata` does cause the records to
materialise, but the resulting descriptor layout exposes a separate
`invalidContextDescriptor` parsing path that is out of scope for the
fixture-coverage tightening effort.

The four sentinel groups stay registration-only. Their `detail:` strings
now record the concrete toolchain gap (rather than the placeholder
"Phase B5" pointer) so future readers don't repeat the experiment.

The experimental fixture file `CanonicalSpecializedMetadata.swift` was
removed from `SymbolTestsCore` after verification — keeping it adds no
test value while shifting unrelated fixture offsets.

Test counts unchanged: 675 tests in 157 suites pass; coverage-invariant
suite still green.

Convert ForeignClassMetadataTests to a real InProcess test against
CoreFoundation.CFString.self — the Swift compiler emits kind 0x203
foreign-class metadata for CoreFoundation types, with the metadata
itself living in CoreFoundation. Reach the metadata via
unsafeBitCast(CFString.self, ...) through a new
InProcessMetadataPicker.coreFoundationCFString carrier.

Add SymbolTestsCore/ForeignTypes.swift with ForeignTypeFixtures
(static functions returning CFString/CFArray) so the bridging-type
usage is documented at the fixture level. Register the matching
foreignTypesSnapshot in SymbolTestsCoreDumpSnapshotTests and update
the SwiftInterface snapshot for the new namespace.

ForeignReferenceTypeMetadata stays sentinel: the kind 0x204 record
is only emitted for C++ types annotated with SWIFT_SHARED_REFERENCE
imported under cxx-interoperability-mode, which SymbolTestsCore does
not enable. Updated allowlist detail captures the rationale.

Regenerate ABI baselines — adding a fixture file shifts every
descriptor offset in SymbolTestsCore, so all Mach-O section-resident
baselines drift slightly. The new ForeignClassMetadataBaseline
records the runtime-resolved kind 0x203 literal for cross-process
stability.

…ueDescriptor/Header

Adds `GenericValueFixtures.FixedSizeArray<let N: Int, T>` to
SymbolTestsCore. The Swift compiler emits a `GenericValueHeader`
(numValues=1) followed by a `GenericValueDescriptor` (type=int) on
the struct's generic context (the `hasValues` bit is set).

Both `GenericValueDescriptorTests` and `GenericValueHeaderTests`
are converted from sentinel registration-only Suites to real
fixture-based cross-reader (`acrossAllReaders`) tests; the
matching baseline generators now read the live carrier through
`BaselineFixturePicker.struct_FixedSizeArray` and emit pinned
literals. The two corresponding sentinel groups in
CoverageAllowlistEntries are removed. All other __Baseline__
files re-emit because the new fixture shifts section offsets.

…l concept

Phase D of fixture-coverage tightening (closes the work). Updates
CLAUDE.md to reflect:
  - acrossAllReaders / usingInProcessOnly distinction
  - typed SentinelReason categorization (runtimeOnly /
    pureDataUtility / needsFixtureExtension)
  - 4-invariant CoverageInvariant (missing / extra / liarSentinel /
    unmarkedSentinel)
  - SuiteBehaviorScanner classification rules (helper substrings +
    direct-reader substrings + class-scope inheritance fallback)
  - regen-baselines SwiftPM plugin path

…o fix

Upstream main fixed `moduleContextDesciptor` -> `moduleContextDescriptor`
(commit 66b10a6). Adapt the fixture-coverage generator, baseline, and
@test func to the corrected name. Build + invariant + full
MachOSwiftSectionTests (678 tests / 157 suites) green.