Reject invalid filesystem capacities and add Dynamic ELF interpreter-handoff (planDynamic)

[thanks-cohn]

Motivation

• Repair two PR Add bounded filesystem and bounded address-space/exec-image modules (Batch 26 substrates) #52 review findings by preventing invalid FileSystem capacities (especially object_capacity == 0 and overflow beyond ObjectId) and by representing dynamic ELF/PT_INTERP interpreter handoff without weakening the verified static ET_EXEC proof.
• Provide small, reusable policy and tests so higher layers can perform interpreter handoff and the real RV64 machine gate work (openat/mmap/execve/PT_INTERP) can proceed consistently.

Description

• Add compile-time capacity validation to FileSystem so object_capacity == 0 is rejected and capacities exceeding the u16 ObjectId namespace are rejected, and ensure the root object slot is initialized. (projects/58-bounded-filesystem/src/bounded_filesystem.zig).
• Add compile-fail fixtures and a focused checker script tools/check-bounded-filesystem-capacity.py to assert both invalid-capacity rejections. (projects/58-bounded-filesystem/tests/compile_fail/*, tools/check-bounded-filesystem-capacity.py).
• Introduce DynamicLoadPlan and planDynamic in the ELF loader module to represent an explicit interpreter-handoff boundary that owns and validates a single NUL-terminated PT_INTERP pathname, tolerates PT_DYNAMIC as interpreter work, and performs no relocation, while preserving the original plan as the strict static ET_EXEC acceptance surface. (projects/54-bounded-elf64-load-plan/src/bounded_elf64_load_plan.zig and updated contract/docs).
• Update the exec staging code (ExecPlan) to consume DynamicLoadPlan facts, derive the PT_INTERP pathname from the validated main ELF, require separately resolved interpreter bytes, reject recursively interpreted interpreters, and choose the interpreter entry while preserving main_entry. (projects/59-bounded-address-space-exec-image/src/bounded_address_space_exec_image.zig).
• Add decisive unit/smoke tests exercising planDynamic acceptance for ET_DYN/PT_INTERP, malformed PT_INTERP rejection, interpreter-missing rejection, and an ExecPlan handoff scenario; update DETAILS.md/MASTERY.md/README.md and command documentation to record the repaired architecture and the focused capacity test command. (multiple projects/* docs changed).

Testing

• Ran unit and smoke runs for the affected modules with zig build test-bounded-filesystem, zig build test-bounded-elf64-load-plan, and zig build test-bounded-address-space-exec-image and their smoke equivalents, and these focused tests passed after the fix.
• Executed the focused capacity regression PYTHONDONTWRITEBYTECODE=1 python3 tools/check-bounded-filesystem-capacity.py and it reported PASS (2/2) validating both compile-fail fixtures.
• Ran contract and repository checks with .venv/bin/python tools/module-contract-consistency-checker.py and PYTHONDONTWRITEBYTECODE=1 python3 tools/check-command-reference.py --check, and they passed; indexes and dependency graphs were regenerated where possible.
• The external freestanding QEMU verifier python3 tools/verify-freestanding-riscv64-linux-fd-lifecycle.py --self-test could not run in this environment because qemu-system-riscv64 was unavailable, so the two-QEMU machine gate remains to be executed in an environment with QEMU; this is a required next step but is an external-environment limitation, not a code regression.

---

Codex Task

[thanks-cohn]

Review update: the substantive Project 58 capacity repair and Project 54/59 dynamic-ELF/PT_INTERP separation look directionally sound for this checkpoint, and the focused Zig tests reached 30/30 under CI. I fixed the two compile-fail fixture formatting failures directly on this PR branch.

Do not merge yet: the fresh CI run still fails deterministic repository-sync gates, not the new unit tests. Remaining repair tasks are:

• regenerate generated/modules.json, generated/public-symbols.json, and generated/endpoints.json;
• synchronize projects/54-bounded-elf64-load-plan/port.js with the updated public symbols/types/functions/methods/errors in details.json;
• synchronize projects/59-bounded-address-space-exec-image/port.js with the changed prepare method signature;
• regenerate validation evidence for the changed bounded-ELF64 module/source digest;
• rerun full zig build check / repository validation and require green CI.

These are continuation/debugging tasks, not reasons to restart or discard the current work. Preserve the branch history and rerun the repo's canonical generators/formatters rather than hand-editing generated artifacts.