fix(ios-prebuild): hash every compose-tooling sibling into the recompose freshness marker

composeToolingHash() covered only three of headers-compose.js's five local
sibling modules, so a local edit to headers-xcframework.js (which
ensureHeadersLayout delegates the ReactNativeHeaders compose and the deps
sidecar build to) or framework-resources.js (privacy manifest + i18n bundle
emission) served stale composed output. Extract the list to
COMPOSE_TOOLING_FILES, add the two missing files, and add a guard test that
parses this file's own requires so the list can't silently drift again —
the same bug class as the CI cache-key hashFiles gap, now unrepresentable.

Also rewrite the stale headers-rules.md paragraph that still described the
removed DEPS_NAMESPACES_NOT_RELOCATED carve-out; SocketRocket lives in
DEPS_NAMESPACES with a single physical home in the deps sidecar.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: chrfalch

packages/react-native/scripts/ios-prebuild/__docs__/headers-rules.md

@@ -356,9 +356,14 @@ These classes previously failed late (consumer CI lane) or not at all; the gate
 Proof the gate earns its keep — its FIRST run found two real shipping defects:
 the dual-identity redefinitions that became R11, and an undeclared
 `SocketRocket` namespace in the deps artifact (caught by the set-equality guard
-the moment it was added). SocketRocket is deliberately NOT relocated
-(`DEPS_NAMESPACES_NOT_RELOCATED`): the real pod vends it, and textual copies
-collide with it under `use_frameworks` — the gate asserts its absence.
+the moment it was added). SocketRocket now lives in `DEPS_NAMESPACES` alongside
+the other third-party deps namespaces, with a single physical home in the
+ReactNativeDependenciesHeaders sidecar: relocating a second textual copy into
+ReactNativeHeaders collided with the real pod's own headers under
+`use_frameworks` (the duplicate-`@interface` / poisoned-module-graph Expo
+regression, 2026-07-03), so the set-equality gate asserts the declared
+namespace set — `DEPS_NAMESPACES` — matches the deps artifact's namespaces
+exactly, in both directions.
 
 ### D. Remaining silent gaps — allowlist maintenance (by design)
 

packages/react-native/scripts/ios-prebuild/__tests__/headers-compose-test.js

@@ -0,0 +1,43 @@
+/**
+ * Copyright (c) Meta Platforms, Inc. and affiliates.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ *
+ * @flow strict-local
+ * @format
+ */
+
+'use strict';
+
+const {
+  COMPOSE_TOOLING_FILES,
+  composeToolingHash,
+} = require('../headers-compose');
+const fs = require('fs');
+const path = require('path');
+
+describe('COMPOSE_TOOLING_FILES stays in sync with headers-compose.js requires', () => {
+  test('every local sibling require is covered by the hashed file list', () => {
+    const source = fs.readFileSync(
+      path.join(__dirname, '..', 'headers-compose.js'),
+      'utf8',
+    );
+    const requireRe = /require\('\.\/([\w-]+)'\)/g;
+    const required = new Set();
+    let match;
+    while ((match = requireRe.exec(source)) != null) {
+      required.add(`${match[1]}.js`);
+    }
+    for (const name of required) {
+      expect(COMPOSE_TOOLING_FILES).toContain(name);
+    }
+  });
+});
+
+describe('composeToolingHash', () => {
+  test('returns a 64-char hex sha256 digest', () => {
+    const hash = composeToolingHash();
+    expect(hash).toMatch(/^[0-9a-f]{64}$/);
+  });
+});

packages/react-native/scripts/ios-prebuild/headers-compose.js

@@ -53,13 +53,23 @@ const CP_FLAGS = process.platform === 'darwin' ? '-Rc' : '-R';
 // forces a recompose even when the cached source xcframework is untouched —
 // the Info.plist mtime alone can't catch that. Stable across fresh checkouts
 // (content-based, not mtime-based). sha256 to avoid weak-hash lint.
+//
+// This list must contain every local sibling module headers-compose.js
+// requires (i.e. every `require('./*.js')` above) — the guard test in
+// __tests__/headers-compose-test.js enforces that by parsing this file's
+// source and diffing it against this list, so an added require without a
+// matching entry here fails the test instead of silently going stale.
+const COMPOSE_TOOLING_FILES /*: Array<string> */ = [
+  'framework-resources.js',
+  'headers-inventory.js',
+  'headers-spec.js',
+  'headers-xcframework.js',
+  'headers-compose.js',
+];
+
 function composeToolingHash() /*: string */ {
   const hash = crypto.createHash('sha256');
-  for (const name of [
-    'headers-inventory.js',
-    'headers-spec.js',
-    'headers-compose.js',
-  ]) {
+  for (const name of COMPOSE_TOOLING_FILES) {
     hash.update(fs.readFileSync(path.join(__dirname, name)));
   }
   return hash.digest('hex');
@@ -376,4 +386,6 @@ module.exports = {
   buildReactNativeHeadersXcframework,
   ensureHeadersLayout,
   DEPS_NAMESPACES,
+  COMPOSE_TOOLING_FILES,
+  composeToolingHash,
 };