尽快推进：收紧OPFS smoke边界

check-linuxcnc-opfs-source-map.sh

@@ -102,6 +102,13 @@ if grep -R -n -E 'localStorage|sessionStorage|indexedDB|showOpenFilePicker|showS
     echo "browser app/wasm code must not add filesystem persistence outside OPFS" >&2
     exit 1
 fi
+if grep -n -E 'localStorage|sessionStorage|indexedDB|showOpenFilePicker|showSaveFilePicker|showDirectoryPicker|webkitRequestFileSystem|FileReader' \
+    web/test-browser-wasm-smoke-*.js \
+    web/test-browser-wasm-smoke.html \
+    test-web-wasm-browser-smoke.sh; then
+    echo "browser OPFS smoke harness must not add filesystem persistence outside OPFS" >&2
+    exit 1
+fi
 
 python3 - <<'PY'
 from pathlib import Path
@@ -132,6 +139,8 @@ required_phrases = [
     "OPFS/WASM mirror persistence",
     "OPFS directory persistence and WASM mirror refresh",
     "OPFS workspace and mount policy",
+    "Browser OPFS smoke harness files must also stay free of Local Storage",
+    "they may only verify OPFS-backed browser persistence",
     "OPFS-backed workspace, directory, parameter-file, and mount/workspace option types",
     "app-level OPFS program, parameter, backup, and reload behavior",
     "./check-linuxcnc-opfs-source-map.sh",

docs/linuxcnc-opfs-source-map.md

@@ -44,6 +44,9 @@ persistence. It is a policy and bridge map only; it must not add independent fil
 - Browser app and wasm bridge code must not use Local Storage, IndexedDB,
   File Picker, Directory Picker, WebKit filesystem, or FileReader persistence
   paths for CNC programs, LinuxCNC parameter files, or mirrored workspace files.
+- Browser OPFS smoke harness files must also stay free of Local Storage,
+  IndexedDB, File Picker, Directory Picker, WebKit filesystem, and FileReader
+  persistence paths; they may only verify OPFS-backed browser persistence.
 - `web/src/app.js` must parse browser programs through
   `parseFileWithParameterFile()` so the program file and LinuxCNC parameter
   state both live under OPFS.