参考所有分组，完成尽量多的内容。禁止顺手扩功能 smoke：锁定dlfcn禁用边界

结论：按 LinuxCNC src/emc/rs274ngc/interp_base.cc 的 dlopen/dlsym/dlerror 调用点，补强 WASM dlfcn shim 与 interp_base probe，确认浏览器安全探针中动态加载保持不可用；不扩展 smoke 解析。

check-linuxcnc-wasm-shims-source-map.sh

@@ -19,7 +19,11 @@ grep -F 'set(linuxcnc_wasm_safe_probe_shims' core/CMakeLists.txt >/dev/null
 grep -F 'LinuxCNC source basis: this guard ties the documented WASM blocker map' \
     check-linuxcnc-wasm-blockers-source-map.sh >/dev/null
 
-grep -F 'dlopen' "$linuxcnc_root/src/emc/rs274ngc/interp_base.cc" >/dev/null
+grep -F 'dlopen(NULL, RTLD_GLOBAL);' "$linuxcnc_root/src/emc/rs274ngc/interp_base.cc" >/dev/null
+grep -F 'interp_lib = dlopen(interp_path, RTLD_NOW);' "$linuxcnc_root/src/emc/rs274ngc/interp_base.cc" >/dev/null
+grep -F 'Constructor constructor = (Constructor)dlsym(interp_lib, "makeInterp");' \
+    "$linuxcnc_root/src/emc/rs274ngc/interp_base.cc" >/dev/null
+grep -F 'dlerror()' "$linuxcnc_root/src/emc/rs274ngc/interp_base.cc" >/dev/null
 grep -F '#define _(s) gettext(s)' "$linuxcnc_root/src/emc/rs274ngc/interp_internal.hh" >/dev/null
 grep -F 'int _task = 0;' "$linuxcnc_root/src/emc/rs274ngc/gcodemodule.cc" >/dev/null
 grep -F 'int _task = 1;' "$linuxcnc_root/src/emc/task/emctaskmain.cc" >/dev/null
@@ -118,6 +122,7 @@ for phrase in [
     "CMake `linuxcnc_wasm_safe_probe_shims` set",
     "RS274/WASM manifest",
     "browser-safe LinuxCNC adaptations",
+    "dynamic loading unavailable",
     "inactive-DB return values",
     "negative-status short-circuit behavior",
 ]:

core/wasm_shims/interp_base_probe_main.cc

@@ -1,8 +1,29 @@
+#include "dlfcn.h"
 #include "interp_base.hh"
 
+#include <cstring>
+
 // LinuxCNC source basis: src/emc/rs274ngc/interp_base.cc provides
-// interp_from_shlib(), with the declaration in interp_base.hh.
+// interp_from_shlib(), with the declaration in interp_base.hh. Its native
+// dlopen()/dlsym() loader edge is intentionally unavailable in WASM probes.
 int main() {
+    if (dlopen(nullptr, RTLD_GLOBAL) != nullptr) {
+        return 2;
+    }
+    if (dlopen("/tmp/cnc_sim_missing_interpreter.so", RTLD_NOW) != nullptr) {
+        return 3;
+    }
+    if (dlsym(nullptr, "makeInterp") != nullptr) {
+        return 4;
+    }
+    const char *error = dlerror();
+    if (!error || !std::strstr(error, "dynamic loading is unavailable")) {
+        return 5;
+    }
+    if (dlclose(nullptr) != 0) {
+        return 6;
+    }
+
     InterpBase *interp = interp_from_shlib("nonexistent-interpreter.so");
     return interp == nullptr ? 0 : 1;
 }

docs/linuxcnc-wasm-shims-source-map.md

@@ -14,7 +14,7 @@ only; it must not add CNC behavior and must not expand the temporary smoke parse
 
 | Shim | LinuxCNC source basis | Boundary |
 | --- | --- | --- |
-| `core/wasm_shims/dlfcn.cc` | `src/emc/rs274ngc/interp_base.cc` | Satisfies native `dlopen` symbols for browser-safe probes. |
+| `core/wasm_shims/dlfcn.cc` | `src/emc/rs274ngc/interp_base.cc` | Satisfies native `dlopen` symbols for browser-safe probes while keeping dynamic loading unavailable. |
 | `core/wasm_shims/emc_status_shim.cc` | `src/emc/sai/dummyemcstat.cc` | Provides the source-backed `emcStatus` singleton shape without task/NML startup. |
 | `core/wasm_shims/gettext_shim.cc` | `src/emc/rs274ngc/interp_internal.hh` | Preserves LinuxCNC diagnostic call sites without browser gettext catalogs. |
 | `core/wasm_shims/linuxcnc_runtime_shim.cc` | `src/emc/rs274ngc/gcodemodule.cc`, `src/emc/task/emctaskmain.cc`, `src/emc/task/taskclass.cc`, `src/emc/rs274ngc/interp_namedparams.cc`, `src/hal/hal_lib.c`, `src/emc/rs274ngc/rs274ngc_pre.cc` | Keeps preview/task, builtin Python module, HAL lookup, and `wordexp()` edges compile-safe. |