I cannot answer question 1. However, I find it hard to imagine that the use of the word must could mean that the rule was optional.
As for question 2, you would need support from the compiler/linker. You cannot reasonably expect to back fit this with a PE editing post-link tool. Consider the following code:
try
Beep;
except
on E: Exception do
Writeln(E.ClassName, ': ', E.Message);
end;
The compiler emits the following:
Project1.dpr.11: try
0041C3AA 33C0 xor eax,eax
0041C3AC 55 push ebp
0041C3AD 68C9C34100 push $0041c3c9 // exception handler is at $0041c3c9
0041C3B2 64FF30 push dword ptr fs:[eax]
0041C3B5 648920 mov fs:[eax],esp
Project1.dpr.12: Beep;
0041C3B8 6A00 push $00
0041C3BA E8E1CEFEFF call MessageBeep
0041C3BF 33C0 xor eax,eax
0041C3C1 5A pop edx
0041C3C2 59 pop ecx
0041C3C3 59 pop ecx
0041C3C4 648910 mov fs:[eax],edx
0041C3C7 EB59 jmp $0041c422
0041C3C9 E97291FEFF jmp @HandleOnException
0041C3CE 0100 add [eax],eax
0041C3D0 0000 add [eax],al
0041C3D2 E42F in al,$2f
0041C3D4 41 inc ecx
0041C3D5 00DA add dl,bl
0041C3D7 C3 ret
0041C3D8 41 inc ecx
0041C3D9 00A3D83E4200 add [ebx+$00423ed8],ah
Project1.dpr.15: Writeln(E.ClassName, ': ', E.Message);
........
Now, the real exception handler is HandleOnException, implemented in System.pas. But, the address pushed onto the stack is $0041c3c9, an address local to the code containing the try/except block. This means that in order to create a SafeSEH PE section you would need to locate each and every try/except in your code. Whilst that is obviously feasible, I don't think it is tractable.
I rather imagined that the SEH exception handlers for the x86 compiler would be just the _HandleXXX functions declared in System.pas. In which case it would be easy enough to add a PE section listing just those functions as a post-link step. However, since every single try/except has its own local exception handler, I now believe that only the compiler author can realistically hope to add the SafeSEH PE section.
There is, so far as I can see, no QC report that requests SafeSEH support for the x86 Windows compiler. I suggest that you log a QC report, and an official support case.
Update: Well done to @haimg for succeeding where I failed and managing to locate a QC report: QC#106781.
