参考所有分组，完成尽量多的内容：收紧browser-app source-map边界守卫

check-linuxcnc-browser-app-source-map.sh

@@ -7,7 +7,7 @@ cd "$(dirname "$0")"
 # LinuxCNC RS274 parameter-file defaults, rs274ngc_pre.cc restore/save/read
 # file semantics, and the existing OPFS-backed wasm-core bridge. It validates
 # app integration policy only; it does not add CNC behavior or expand smoke
-# parsing.
+# parsing, or interpret G-code.
 linuxcnc_root=${LINUXCNC_ROOT:-../linuxcnc}
 linuxcnc_root=$(cd "$linuxcnc_root" && pwd)
 
@@ -104,10 +104,20 @@ for phrase in [
     "parameters/rs274ngc.var",
     "visible backend selector must stay limited",
     "./check-linuxcnc-browser-app-source-map.sh",
+    "does not interpret G-code",
 ]:
     if phrase not in source_map:
         raise SystemExit(f"docs/linuxcnc-browser-app-source-map.md missing boundary phrase: {phrase}")
 
+for entry in [
+    "test-native.sh",
+    "test-linuxcnc-source-link.sh",
+    "build-wasm.sh",
+]:
+    text = Path(entry).read_text(encoding="utf-8")
+    if "./check-linuxcnc-browser-app-source-map.sh" not in text:
+        raise SystemExit(f"{entry} must run ./check-linuxcnc-browser-app-source-map.sh")
+
 app = Path("web/src/app.js").read_text(encoding="utf-8")
 if "parse(" in app.replace("parseProgram", ""):
     raise SystemExit("browser app should route program execution through parseFileWithParameterFile, not direct parse")

docs/linuxcnc-browser-app-source-map.md

@@ -37,6 +37,11 @@ must not expand the temporary smoke parser.
 - The app must require OPFS for browser program parsing and call
   `parseFileWithParameterFile(programPath, parameterPath, "linuxcnc", ...)`.
 - The visible backend selector must stay limited to the LinuxCNC RS274 backend.
+- `test-native.sh`, `test-linuxcnc-source-link.sh`, and `build-wasm.sh` must
+  run `./check-linuxcnc-browser-app-source-map.sh` before consuming app-backed
+  browser artifacts or source-linked LinuxCNC objects.
+- The browser app source-map guard validates LinuxCNC source-backed bridge
+  routing and OPFS policy only; it does not interpret G-code.
 
 ## Checks
 
@@ -46,6 +51,7 @@ Run:
 ./check-linuxcnc-browser-app-source-map.sh
 ./test-native.sh
 ./test-linuxcnc-source-link.sh
+./build-wasm.sh
 ```
 
 `check-linuxcnc-browser-app-source-map.sh` keeps this document, LinuxCNC source