What is the temporal relation between the execution of dealloc and the point where weak references are broken and where entries are removed from an NSMapTable?
In particular, can I be sure that when dealloc starts to execute, there are no strong references left from the point of view of the application, and that no new strong references can be obtained (except maybe by copying self during the execution of dealloc)?
Yes you can be sure.
The explanation is clearly stated in this other answer.
The gist of it is that the resolution of a weak reference is often done implicitly through a low-level API that takes into account whether the deallocation has already started for the instance pointed at by the reference.