v2.0 — 31 C POC twins + harness fixes

- 31 C POC files, one per CVE folder: full seed construction + trigger +
  main(), self-contained, no app dependency. All compile clean with
  clang -O2 -Wall (zero warnings) on macOS arm64; each has a recorded
  oracle on this host.
- CMGetDMVersionLevelFromRPU ABI pinned by disassembly: macOS export is
  (CFDataRef), the Swift POC drives the 4-arg iOS surface — this is the
  mechanism behind the cm.rpu death oracle on the simulator build.
- Harness fixes: glyphCount guard, MachOInspector size guard, ModTools
  clamp, DeviceModel iPhone19,7, GPTPayload clamps, Gate patch display.
- POC comments rewritten English-only (31 swift + arc.rr + 5 py).
- README (en/zh): C twin column, .c anatomy section, compile/run
  examples, C oracle verification status.
- Dead if-let binding removed from Identity summary; v2.0 build 3.

CVE-2026-112554/CVE-2026-112554.swift

@@ -1,24 +1,11 @@
 // kext.gpt · IOStorageFamily · CVE-2026-112554
-// 原语: OOB 读 · 内核 · tier 2
-// Primitive: OOB read · kernel · tier 2
-//
-// [zh] GPT 分区名扫描 72 字节内核堆越界读
-// 分区名扫描的边界常量由 0x48 收紧至 0x24。0x48 即 72 字节，而 GPT 条目内的名字域仅 36 个 UTF-16 单元；27.0 的扫描因此越过条目尾，读入相邻内核堆。
-//
-// [en] GPT partition name scan 72-byte kernel heap out-of-bounds read
-// The partition name scan's bound constant tightens from 0x48 to 0x24. 0x48 is 72 bytes, while the
-// name field inside a GPT entry is only 36 UTF-16 units, so the 27.0 scan runs past the entry tail
-// and into adjacent kernel heap.
-// ── 判别 / oracle ──
-// 应用侧无法 attach 磁盘镜像，故本模块做两件事：构造会使 27.0 越界的镜像，并在用户态解析一遍以证明名字域确实在条目内被截断 —— 越界读发生在内核侧，不在用户态。
-
+// GPT partition name scan 72-byte kernel heap out-of-bounds read
 import Foundation
 
-// 本地化直通 shim — app 内该函数经 RuntimeText 映射输出双语。
-// identity localization shim — the app routes this through RuntimeText.
+// identity localization shim — passes the string through unchanged.
 func tl(_ s: String) -> String { s }
 
-// ── byte helpers — verbatim from Cinder27 Sources/Kit.swift ──
+// ── byte helpers (from Cinder27 Sources/Kit.swift) ──
 enum B {
     static func be16(_ v: UInt16) -> [UInt8] { [UInt8(v >> 8 & 0xff), UInt8(v & 0xff)] }
     static func le16(_ v: UInt16) -> [UInt8] { [UInt8(v & 0xff), UInt8(v >> 8 & 0xff)] }
@@ -39,19 +26,19 @@ enum B {
     static func ascii(_ s: String) -> [UInt8] { Array(s.utf8) }
 }
 
-// ── 种子构造 / seed construction — verbatim from Cinder27 Sources (GPTPayload) ──
+// ── seed construction (from Cinder27 Sources: GPTPayload) ──
 enum GPTPayload {
 static func describe(_ image: Data) -> [String] {
         var lines: [String] = []
-        guard image.count >= 1024 else { return [tl("镜像过短")] }
+        guard image.count >= 1024 else { return [tl("image too short")] }
         let sig = [UInt8](image[512..<520])
         guard sig.starts(with: [0x45, 0x46, 0x49, 0x20, 0x50, 0x41, 0x52, 0x54]) else {
-            return [tl("无 GPT 签名")]
+            return [tl("no GPT signature")]
         }
         let entryLBA = image.withUnsafeBytes { $0.load(fromByteOffset: 512 + 72, as: UInt64.self) }
         let entryCount = image.withUnsafeBytes { $0.load(fromByteOffset: 512 + 80, as: UInt32.self) }
         let entrySize = image.withUnsafeBytes { $0.load(fromByteOffset: 512 + 84, as: UInt32.self) }
-        lines.append(tl("GPT 头: 条目表 LBA ") + "\(entryLBA)" + tl(" · ") + "\(entryCount)" + tl(" 项 · 每项 ") + "\(entrySize)" + tl(" B"))
+        lines.append(tl("GPT header: entry LBA ") + "\(entryLBA)" + tl(" · ") + "\(entryCount)" + tl(" entries · ") + "\(entrySize)" + tl(" B"))
         let base = Int(entryLBA) * 512
         for i in 0..<Int(entryCount) {
             let off = base + i * Int(entrySize)
@@ -65,7 +52,7 @@ static func describe(_ image: Data) -> [String] {
                 units.append(unit)
             }
             let name = String(decoding: units, as: UTF16.self)
-            if !name.isEmpty { lines.append(tl("  分区 ") + "\(i)" + tl(": ") + "\(name)") }
+            if !name.isEmpty { lines.append(tl("  partition ") + "\(i)" + tl(": ") + "\(name)") }
         }
         return lines
     }