按规划继续工作

结论：补充 INI 派生机器文件名的 OPFS 路径拒绝回归测试，确认非法遍历和嵌套路径不会进入主机存储，并通过 host/WASM/browser 聚合验证。

wasm-port/docs/compatibility-validation.md

@@ -103,7 +103,9 @@ round-trip store plus pure-text machine file and G-code stores without
 defining CNC machine-state or file-format semantics. It now also validates the
 OPFS-to-WASM parameter-file bridge with a mock interpreter SDK to ensure the
 host boundary copies text into and out of the WASM filesystem without defining
-parameter semantics.
+parameter semantics, and that INI-derived machine file names are still
+rejected by the OPFS path model when they contain traversal or nested path
+segments.
 
 The browser INI/OPFS smoke script serves `wasm-port/` over localhost and runs
 Chromium headless against a test page that imports the JS SDK, loads the INI
@@ -257,9 +259,10 @@ SDK into vendored LinuxCNC file APIs, the Node machine-session bridge that
 groups INI, parameter, and tool-table loading, the random-toolchanger flag
 derived from vendored LinuxCNC INI boolean parsing, INI-derived
 `[RS274NGC]PARAMETER_FILE` and `[EMCIO]TOOL_TABLE` file names mapped to OPFS
-machine files, and a browser interpreter smoke that uses the same session
-bridge before saving OPFS-backed parameter and tool-table text through
-vendored LinuxCNC file APIs.
+machine files, OPFS path-model rejection of invalid INI-derived file names,
+and a browser interpreter smoke that uses the same session bridge before
+saving OPFS-backed parameter and tool-table text through vendored LinuxCNC
+file APIs.
 Full browser coverage, full SDK coverage, and richer machine-state validation
 remain future work.