参考所有分组，完成尽量多的内容：收紧WASM shims source-map边界守卫

check-linuxcnc-wasm-shims-source-map.sh

@@ -6,7 +6,7 @@ cd "$(dirname "$0")"
 # LinuxCNC source basis: this guard ties the documented wasm-safe shim map to
 # the linuxcnc_wasm_safe_probe_shims CMake set, the RS274/WASM source manifest,
 # and the LinuxCNC sources each shim cites. It validates source coverage only;
-# it does not add CNC behavior or expand smoke parsing.
+# it does not add CNC behavior, expand smoke parsing, or interpret G-code.
 linuxcnc_root=${LINUXCNC_ROOT:-../linuxcnc}
 manifest=${1:-linuxcnc-rs274-wasm-source-files.txt}
 
@@ -134,10 +134,21 @@ for phrase in [
     "unavailable HAL lookup",
     "inactive-DB return values",
     "negative-status short-circuit behavior",
+    "./check-linuxcnc-wasm-shims-source-map.sh",
+    "does not interpret G-code",
 ]:
     if phrase not in source_map:
         raise SystemExit(f"docs/linuxcnc-wasm-shims-source-map.md missing boundary phrase: {phrase}")
 
+for entry in [
+    "test-native.sh",
+    "test-linuxcnc-source-link.sh",
+    "build-wasm.sh",
+]:
+    text = Path(entry).read_text(encoding="utf-8")
+    if "./check-linuxcnc-wasm-shims-source-map.sh" not in text:
+        raise SystemExit(f"{entry} must run ./check-linuxcnc-wasm-shims-source-map.sh")
+
 cmake_text = Path("core/CMakeLists.txt").read_text(encoding="utf-8")
 for shim_path in shim_paths:
     cmake_suffix = shim_path.removeprefix("core/")

docs/linuxcnc-wasm-shims-source-map.md

@@ -32,6 +32,11 @@ only; it must not add CNC behavior and must not expand the temporary smoke parse
 - Each shim source must keep a nearby `LinuxCNC source basis:` comment naming the LinuxCNC source it adapts.
 - Every LinuxCNC source named above must remain tracked in the RS274/WASM manifest as `core`, `header`, or `metadata`.
 - These shims are browser-safe LinuxCNC adaptations for source-link probes; they are not new interpreter behavior.
+- `test-native.sh`, `test-linuxcnc-source-link.sh`, and `build-wasm.sh` must
+  run `./check-linuxcnc-wasm-shims-source-map.sh` before consuming shim-backed
+  source-linked LinuxCNC objects or browser artifacts.
+- The WASM shims source-map guard validates LinuxCNC source/shim ownership and
+  manifest drift only; it does not interpret G-code.
 
 ## Checks
 
@@ -42,6 +47,7 @@ Run:
 ./test-linuxcnc-wasm-cmake-safe-probe.sh
 ./test-native.sh
 ./test-linuxcnc-source-link.sh
+./build-wasm.sh
 ```
 
 `check-linuxcnc-wasm-shims-source-map.sh` keeps this document, the CMake shim