按规划继续工作

结论：补齐通用会话快照 envelope 的格式、版本、会话 ID 与对象形状拒绝验证，覆盖 Node OPFS 与 Chromium OPFS 路径，并通过 host/WASM/browser 聚合验证。

wasm-port/tests/browser/ini_panel_smoke.html

@@ -9,7 +9,7 @@
   <script type="module">
     import { createLinuxCncIniSdk } from "../../runtime/sdk/src/index.js";
     import { loadTextFile, saveTextFile } from "../../runtime/opfs/file-service.js";
-    import { machineIniPath } from "../../runtime/opfs/path-model.js";
+    import { machineIniPath, sessionSnapshotPath } from "../../runtime/opfs/path-model.js";
     import {
       loadSessionSnapshot,
       saveSessionSnapshot,
@@ -29,6 +29,18 @@
       }
     }
 
+    async function assertRejects(label, operation, expectedPattern) {
+      try {
+        await operation();
+      } catch (error) {
+        if (!expectedPattern.test(error.message)) {
+          throw new Error(`${label}: unexpected error ${error.message}`);
+        }
+        return;
+      }
+      throw new Error(`${label}: expected rejection`);
+    }
+
     function delay(ms) {
       return new Promise((resolve) => setTimeout(resolve, ms));
     }
@@ -104,6 +116,44 @@ JOINTS = 3
       assertEqual(loadedSnapshot.createdAt, savedSnapshot.createdAt, "snapshot timestamp");
       assertEqual(loadedSnapshot.payload.files.ini, opfsPath, "snapshot payload");
       assertEqual(loadedSnapshot.metadata.source, "browser-smoke", "snapshot metadata");
+      await saveTextFile(
+        sessionSnapshotPath("browser-bad-format"),
+        JSON.stringify({
+          ...loadedSnapshot,
+          format: "other-format",
+          sessionId: "browser-bad-format",
+        }),
+      );
+      await assertRejects(
+        "browser snapshot bad format",
+        () => loadSessionSnapshot("browser-bad-format"),
+        /Unsupported session snapshot format/,
+      );
+      await saveTextFile(
+        sessionSnapshotPath("browser-bad-version"),
+        JSON.stringify({
+          ...loadedSnapshot,
+          version: 99,
+          sessionId: "browser-bad-version",
+        }),
+      );
+      await assertRejects(
+        "browser snapshot bad version",
+        () => loadSessionSnapshot("browser-bad-version"),
+        /Unsupported session snapshot version/,
+      );
+      await saveTextFile(
+        sessionSnapshotPath("browser-bad-session-id"),
+        JSON.stringify({
+          ...loadedSnapshot,
+          sessionId: "other-browser-session",
+        }),
+      );
+      await assertRejects(
+        "browser snapshot id mismatch",
+        () => loadSessionSnapshot("browser-bad-session-id"),
+        /Session snapshot id mismatch/,
+      );
 
       await saveMachineTextFiles("browser-smoke", {
         ini: iniText,