按规划继续工作

结论：补齐通用会话快照 envelope 的格式、版本、会话 ID 与对象形状拒绝验证，覆盖 Node OPFS 与 Chromium OPFS 路径，并通过 host/WASM/browser 聚合验证。

wasm-port/tests/opfs/node/verify_file_service.mjs

@@ -130,6 +130,26 @@ assert.deepEqual(snapshot, {
   payload: snapshotPayload,
 });
 assert.equal(validateSessionSnapshot(snapshot, "session-1"), snapshot);
+assert.throws(
+  () => validateSessionSnapshot({ ...snapshot, format: "other-format" }, "session-1"),
+  /Unsupported session snapshot format/,
+);
+assert.throws(
+  () => validateSessionSnapshot({ ...snapshot, version: 99 }, "session-1"),
+  /Unsupported session snapshot version/,
+);
+assert.throws(
+  () => validateSessionSnapshot({ ...snapshot, sessionId: "other-session" }, "session-1"),
+  /Session snapshot id mismatch/,
+);
+assert.throws(
+  () => validateSessionSnapshot({ ...snapshot, metadata: null }, "session-1"),
+  /snapshot metadata must be a plain object/,
+);
+assert.throws(
+  () => validateSessionSnapshot({ ...snapshot, payload: [] }, "session-1"),
+  /snapshot payload must be a plain object/,
+);
 
 await saveTextFile(
   "linuxcnc/machines/xyzab.ini",
@@ -558,6 +578,33 @@ await assert.rejects(
   () => loadSessionSnapshot("bad-json", { storage }),
   /Invalid session snapshot JSON/,
 );
+await saveTextFile(
+  sessionSnapshotPath("bad-format"),
+  JSON.stringify({ ...snapshot, sessionId: "bad-format", format: "other-format" }),
+  storage,
+);
+await assert.rejects(
+  () => loadSessionSnapshot("bad-format", { storage }),
+  /Unsupported session snapshot format/,
+);
+await saveTextFile(
+  sessionSnapshotPath("bad-version"),
+  JSON.stringify({ ...snapshot, sessionId: "bad-version", version: 99 }),
+  storage,
+);
+await assert.rejects(
+  () => loadSessionSnapshot("bad-version", { storage }),
+  /Unsupported session snapshot version/,
+);
+await saveTextFile(
+  sessionSnapshotPath("bad-session-id"),
+  JSON.stringify({ ...snapshot, sessionId: "other-session" }),
+  storage,
+);
+await assert.rejects(
+  () => loadSessionSnapshot("bad-session-id", { storage }),
+  /Session snapshot id mismatch/,
+);
 await assert.rejects(
   () => loadSessionSnapshot("missing-session", { storage }),
   /missing directory|missing file/,