尽快推进：收紧HAL运行时shim边界

docs/linuxcnc-wasm-shims-source-map.md

@@ -26,6 +26,18 @@ only; it must not add CNC behavior and must not expand the temporary smoke parse
 | `core/wasm_shims/tooldata/tooldata_runtime_stubs.cc` | `src/emc/tooldata/tooldata_nml.cc`, `src/emc/tooldata/tooldata_db.cc` | Satisfies NML and external tool database entry points without native services, preserving inactive-DB return values. |
 | `core/wasm_shims/pythonplugin/python_plugin.cc` | `src/emc/pythonplugin/python_plugin.cc`, `src/emc/pythonplugin/python_plugin.hh` | Keeps LinuxCNC PythonPlugin API and negative-status short-circuit behavior available while Python execution is disabled for browser-safe probes. |
 
+## Runtime Shim Boundaries
+
+- `core/wasm_shims/linuxcnc_runtime_shim.cc` must keep `_task=0` for preview,
+  matching `src/emc/rs274ngc/gcodemodule.cc`; it must not switch browser-safe probes into task mode.
+- The HAL lookup shim covers `hal_get_pin_value_by_name()`,
+  `hal_get_signal_value_by_name()`, and `hal_get_param_value_by_name()` from
+  `src/emc/rs274ngc/interp_namedparams.cc`, `include/hal.h`, and
+  `src/hal/hal_lib.c`; it must leave HAL values unavailable by returning `-1`,
+  `HAL_TYPE_UNINITIALIZED`, and null data pointers.
+- `wordexp()` support is limited to the browser-safe path expansion needed by
+  `src/emc/rs274ngc/rs274ngc_pre.cc`; it must not become a shell expansion feature.
+
 ## Boundaries
 
 - The CMake `linuxcnc_wasm_safe_probe_shims` set and `list-linuxcnc-wasm-safe-shims.sh` must stay synchronized.