Platform: version restricted-host execution policy profiles

Parent: #500 Related: #483, #498, #499

Problem

The generated release matrix records Linux x86-64 and macOS arm64 evidence, then collapses every requested Windows and restricted-Darwin boundary into a single unstructured “No Windows release platform” sentence. It does not machine-readably identify ABI, native/no-JIT/AOT mode, executable-memory policy, sanitizer availability, CI/evidence host, or why each profile remains unsupported. That makes #500 policy drift easy to hide and gives embedders no exact fail-closed contract.

Scope

• Version the matrix schema and retain the accepted V1 artifact as history.
• Add explicit profiles for Windows x86-64, Windows ARM64, iOS, tvOS, visionOS, and macOS with JIT disabled by policy.
• Record architecture, ABI, execution mode, executable policy, sanitizer status, CI/evidence status, support status, and exact blocking dependencies for every profile.
• Bind native claims to the owned executable-memory and optimizer inventories; unsupported or planned profiles must never render as released.
• Generate the Markdown boundary from the same data and validate exact profile membership, uniqueness, and required fields.

No-workaround rules

No cross-build or emulator result labeled real-hardware support, no restricted host attempting MAP_JIT, no invented OS version, no implicit fallback labeled a fast VM/AOT profile, and no deletion or rewriting of the accepted V1 evidence.

Acceptance

• V2 machine-readable profiles cover every #500 requested host and name all required policy fields.
• The generated documentation distinguishes released evidence from planned/unsupported profiles without broadening claims.
• Validation fails on a missing/duplicate profile, unsupported profile marked released, native profile without matching executable-memory/optimizer support, or restricted profile that permits executable mapping.
• Release-compatibility and docs accuracy gates pass; tooling/docs only, 0 Test262 flips.

Implemented and pushed in 8106a0d2.

The V2 matrix preserves the accepted V1 artifact and publishes exactly eight profiles: two existing evidence-backed boundaries plus six explicit unsupported Windows/restricted-Darwin profiles. Every profile records ABI, minimum OS version state, execution mode, executable-memory policy, sanitizer/CI status, evidence host, and blocking dependencies. Native claims are checked against both the optimizer inventory and executable-memory source contract.

Fail-closed validation covers duplicate/missing profiles, unsupported profiles advertised as released, missing released gates, restricted executable mappings, restricted native JIT, and native tuples absent from the owned inventories.

Validation:

• generator verification and fail-closed self-test passed
• release compatibility: 12/12 gates green, private ABI pending 0
• docs manifest/build: 49 pages
• offline link audit: 267 files, all links resolve
• tooling/docs only: 0 Test262 flips

Fresh pushed CI is pending before closure.

Implemented and released by tools(platform): version restricted host profiles (#658).

The V2 inventory now covers all eight exact profiles, retains the accepted V1 artifact, binds native claims to executable-memory and optimizer anchors, and renders unsupported restricted-host boundaries from the same checked data. Mutation self-tests cover missing and duplicate profiles, false release state, unsupported evidence, restricted executable mappings, and unknown native tuples.

Validation evidence:

• local release compatibility: 12/12 gates green
• local docs build: 49 pages
• local link audit: 267 files, all links resolved
• fresh Linux docs job: passed
• tooling/docs only: 0 Test262 flips

No runtime support claim was broadened: unsupported hosts remain explicitly unsupported with concrete blockers.