diff --git a/reports/dev-gate/dev-cloud-workbench-dom-only.json b/reports/dev-gate/dev-cloud-workbench-dom-only.json
new file mode 100644
index 00000000..1a7908c0
--- /dev/null
+++ b/reports/dev-gate/dev-cloud-workbench-dom-only.json
@@ -0,0 +1,546 @@
+{
+  "$schema": "https://hwlab.pikastech.local/schemas/dev-gate-report.schema.json",
+  "$id": "https://hwlab.pikastech.local/reports/dev-gate/dev-cloud-workbench-dom-only.json",
+  "reportVersion": "v1",
+  "status": "blocked",
+  "issue": "pikasTech/HWLAB#7",
+  "taskId": "dev-cloud-workbench-live",
+  "commitId": "29e4c8667af8",
+  "acceptanceLevel": "dev_cloud_workbench_live",
+  "devOnly": true,
+  "prodDisabled": true,
+  "reportLifecycle": {
+    "version": "v1",
+    "state": "active",
+    "activeEndpoint": "http://74.48.78.17:16667",
+    "activeBrowserEndpoint": "http://74.48.78.17:16666",
+    "deprecatedEndpoint": null,
+    "summary": "Current deployed browser user journey report for the 16666 Cloud Workbench; it does not substitute for M3/M4/M5 hardware acceptance."
+  },
+  "task": "DC-DCSN-P0-2026-003",
+  "refs": [
+    "pikasTech/HWLAB#7",
+    "pikasTech/HWLAB#108",
+    "pikasTech/HWLAB#99",
+    "pikasTech/HWLAB#78",
+    "pikasTech/HWLAB#117",
+    "pikasTech/HWLAB#118",
+    "pikasTech/HWLAB#119",
+    "pikasTech/HWLAB#120",
+    "pikasTech/HWLAB#131",
+    "pikasTech/HWLAB#164"
+  ],
+  "mode": "dom-only",
+  "url": "http://74.48.78.17:16666/",
+  "generatedAt": "2026-05-23T05:04:35.743Z",
+  "evidenceLevel": "BLOCKED",
+  "devLive": false,
+  "sourceIdentity": {
+    "status": "observed",
+    "source": "git-head",
+    "commitId": "29e4c8667af85a944a0b848d4a83ae9f275bd639",
+    "shortCommitId": "29e4c8667af8",
+    "ref": "test/d601-dom-only-feedback-validation",
+    "worktreeState": "clean",
+    "dirty": false,
+    "reportCommitId": "29e4c8667af8",
+    "summary": "Source identity was derived from the current worktree or source environment and is separate from the live runtime identity."
+  },
+  "runtimeIdentity": {
+    "status": "observed",
+    "source": "health-live",
+    "endpoint": "http://74.48.78.17:16667/health/live",
+    "serviceId": "hwlab-cloud-api",
+    "environment": "dev",
+    "healthStatus": "degraded",
+    "ready": false,
+    "commitId": "892a027",
+    "commitSource": "runtime-env",
+    "imageTag": "892a027",
+    "observedAt": "2026-05-23T05:04:16.411Z",
+    "runtime": {
+      "durable": false,
+      "ready": false,
+      "status": "blocked",
+      "blocker": "runtime_durable_adapter_query_blocked",
+      "connection": {
+        "queryAttempted": true,
+        "queryResult": "query_blocked"
+      }
+    },
+    "readiness": {
+      "ready": false,
+      "status": "degraded",
+      "durability": {
+        "ready": false,
+        "status": "blocked",
+        "blocker": "runtime_durable_adapter_query_blocked",
+        "blockedLayer": "durability_query",
+        "queryResult": "query_blocked"
+      }
+    },
+    "blockerCodes": [
+      "runtime_durable_adapter_query_blocked"
+    ],
+    "summary": "Live runtime identity was observed through the existing read-only health endpoint and is not inferred from source git HEAD."
+  },
+  "expectedRuntimeIdentity": {
+    "status": "observed",
+    "serviceId": "hwlab-cloud-api",
+    "source": "deploy/artifact-catalog.dev.json+deploy/deploy.json",
+    "commitId": "7de6edd",
+    "imageTag": "7de6edd",
+    "image": "127.0.0.1:5000/hwlab/hwlab-cloud-api:7de6edd",
+    "summary": "Expected DEV runtime identity was derived from current source deploy desired state, not from live health."
+  },
+  "deploymentIdentity": {
+    "status": "blocked",
+    "expectedCommit": "7de6edd",
+    "expectedReportCommitId": "29e4c8667af8",
+    "expectedImageTag": "7de6edd",
+    "expectedSource": "deploy/artifact-catalog.dev.json+deploy/deploy.json",
+    "observedRuntimeCommit": "892a027",
+    "observedImageTag": "892a027",
+    "reason": "live API runtime commit/image tag does not match current source desired runtime identity",
+    "evidence": [
+      "expected=7de6edd",
+      "expectedImageTag=7de6edd",
+      "runtimeCommit=892a027",
+      "imageTag=892a027"
+    ],
+    "summary": "Deployment drift: live API runtime commit/image tag does not match current source desired runtime identity."
+  },
+  "webAssetIdentity": {
+    "status": "blocked",
+    "assets": [
+      {
+        "path": "index.html",
+        "status": "match",
+        "httpStatus": 200,
+        "contentType": "text/html; charset=utf-8",
+        "sourceHash": "435edb7da5c539ff",
+        "liveHash": "435edb7da5c539ff",
+        "sourceLength": 13844,
+        "liveLength": 13844
+      },
+      {
+        "path": "styles.css",
+        "status": "match",
+        "httpStatus": 200,
+        "contentType": "text/css; charset=utf-8",
+        "sourceHash": "95574eda6090e34b",
+        "liveHash": "95574eda6090e34b",
+        "sourceLength": 21184,
+        "liveLength": 21184
+      },
+      {
+        "path": "app.mjs",
+        "status": "mismatch",
+        "httpStatus": 200,
+        "contentType": "text/javascript; charset=utf-8",
+        "sourceHash": "3f2c73f2754c2560",
+        "liveHash": "6a7a13a4b4e9a891",
+        "sourceLength": 67973,
+        "liveLength": 65664
+      }
+    ],
+    "mismatches": [
+      "app.mjs"
+    ],
+    "summary": "Deployment drift: live 16666 primary web assets differ from current source (app.mjs)."
+  },
+  "sourceContract": {
+    "status": "pass",
+    "documents": [
+      "docs/cloud-web-workbench.md",
+      "docs/reference/cloud-workbench.md",
+      "docs/reference/code-agent-chat-readiness.md"
+    ],
+    "summary": "The deployed browser journey is anchored to the Cloud Workbench and Code Agent readiness contracts."
+  },
+  "validationCommands": [
+    "node --check scripts/dev-cloud-workbench-smoke.mjs",
+    "node --check scripts/src/dev-cloud-workbench-smoke-lib.mjs",
+    "node scripts/dev-cloud-workbench-smoke.mjs --static",
+    "node scripts/dev-cloud-workbench-smoke.mjs --mobile",
+    "node scripts/dev-cloud-workbench-smoke.mjs --local-agent-fixture",
+    "node scripts/dev-cloud-workbench-smoke.mjs --dom-only --url http://74.48.78.17:16666/ --report reports/dev-gate/dev-cloud-workbench-dom-only.json",
+    "node scripts/dev-cloud-workbench-smoke.mjs --live --url http://74.48.78.17:16666/ --report reports/dev-gate/dev-cloud-workbench-live.json",
+    "node scripts/validate-dev-gate-report.mjs reports/dev-gate/dev-cloud-workbench-dom-only.json",
+    "node scripts/validate-dev-gate-report.mjs"
+  ],
+  "localSmoke": {
+    "status": "not_run",
+    "commands": [
+      "node scripts/dev-cloud-workbench-smoke.mjs --static",
+      "node scripts/dev-cloud-workbench-smoke.mjs --mobile",
+      "node scripts/dev-cloud-workbench-smoke.mjs --local-agent-fixture"
+    ],
+    "evidence": [
+      "Static mode verifies the source contract and same-origin Code Agent wiring only.",
+      "Mobile browser mode verifies the 390x844 outer-scroll lock and help route at SOURCE level.",
+      "Local fixture browser mode verifies send/reply UX at SOURCE level."
+    ],
+    "summary": "Static, mobile, and local fixture workbench smokes are SOURCE-level evidence and do not prove the deployed browser journey."
+  },
+  "dryRun": {
+    "status": "not_applicable",
+    "commands": [
+      "node scripts/dev-cloud-workbench-smoke.mjs --static"
+    ],
+    "evidence": [
+      "No dry-run substitute is accepted for the deployed browser journey."
+    ],
+    "summary": "The journey evidence is collected from the real DEV browser endpoint, not a dry-run fixture."
+  },
+  "devPreconditions": {
+    "status": "blocked",
+    "requirements": [
+      "GET http://74.48.78.17:16666/ serves the Cloud Workbench HTML.",
+      "Browser DOM exposes the default workbench and core controls.",
+      "DOM-only mode may inspect read-only deployed DOM wiring after identity preflight blocks, but must not send Code Agent chat.",
+      "A controlled same-origin POST /v1/agent/chat returns completed UI-visible evidence or reports a blocker.",
+      "No hardware write API, service restart, PROD access, or secret read is performed."
+    ],
+    "commands": [
+      "node scripts/dev-cloud-workbench-smoke.mjs --dom-only --url http://74.48.78.17:16666/ --report reports/dev-gate/dev-cloud-workbench-dom-only.json",
+      "node scripts/dev-cloud-workbench-smoke.mjs --live --url http://74.48.78.17:16666/ --report reports/dev-gate/dev-cloud-workbench-live.json"
+    ],
+    "summary": "Deployed browser DOM was inspected read-only; Code Agent chat was not posted."
+  },
+  "endpoints": {
+    "frontend": "http://74.48.78.17:16666",
+    "api": "http://74.48.78.17:16667",
+    "edge": "http://74.48.78.17:16667"
+  },
+  "checks": [
+    {
+      "id": "live-api-runtime-readiness",
+      "status": "degraded",
+      "summary": "Live API is reachable but degraded/read-only; runtime durability is not ready, so this cannot be full DEV-LIVE acceptance.",
+      "evidence": [
+        "api.status=degraded",
+        "ready=false",
+        "runtime.durable=false",
+        "runtime.ready=false",
+        "durability.ready=false",
+        "runtime_durable_adapter_query_blocked",
+        "blocker=runtime_durable_adapter_query_blocked"
+      ],
+      "observations": {
+        "status": "degraded",
+        "healthStatus": "degraded",
+        "ready": false,
+        "runtimeDurable": false,
+        "runtimeReady": false,
+        "durabilityReady": false,
+        "durableBlocked": true,
+        "blockerCodes": [
+          "runtime_durable_adapter_query_blocked"
+        ],
+        "evidence": [
+          "api.status=degraded",
+          "ready=false",
+          "runtime.durable=false",
+          "runtime.ready=false",
+          "durability.ready=false",
+          "runtime_durable_adapter_query_blocked",
+          "blocker=runtime_durable_adapter_query_blocked"
+        ],
+        "summary": "Live API is reachable but degraded/read-only; runtime durability is not ready, so this cannot be full DEV-LIVE acceptance."
+      }
+    },
+    {
+      "id": "live-runtime-current-main",
+      "status": "blocked",
+      "summary": "Deployment drift: live API runtime commit/image tag does not match current source desired runtime identity.",
+      "evidence": [
+        "expected=7de6edd",
+        "expectedImageTag=7de6edd",
+        "runtimeCommit=892a027",
+        "imageTag=892a027"
+      ],
+      "observations": {
+        "status": "blocked",
+        "expectedCommit": "7de6edd",
+        "expectedReportCommitId": "29e4c8667af8",
+        "expectedImageTag": "7de6edd",
+        "expectedSource": "deploy/artifact-catalog.dev.json+deploy/deploy.json",
+        "observedRuntimeCommit": "892a027",
+        "observedImageTag": "892a027",
+        "reason": "live API runtime commit/image tag does not match current source desired runtime identity",
+        "evidence": [
+          "expected=7de6edd",
+          "expectedImageTag=7de6edd",
+          "runtimeCommit=892a027",
+          "imageTag=892a027"
+        ],
+        "summary": "Deployment drift: live API runtime commit/image tag does not match current source desired runtime identity."
+      }
+    },
+    {
+      "id": "live-http-html",
+      "status": "pass",
+      "summary": "Live URL serves the Cloud Workbench HTML.",
+      "evidence": [
+        "http://74.48.78.17:16666/",
+        "HTTP 200",
+        "text/html; charset=utf-8"
+      ]
+    },
+    {
+      "id": "live-web-assets-current-main",
+      "status": "blocked",
+      "summary": "Deployment drift: live 16666 primary web assets differ from current source (app.mjs).",
+      "evidence": [
+        "index.html: match",
+        "styles.css: match",
+        "app.mjs: mismatch"
+      ],
+      "observations": {
+        "status": "blocked",
+        "assets": [
+          {
+            "path": "index.html",
+            "status": "match",
+            "httpStatus": 200,
+            "contentType": "text/html; charset=utf-8",
+            "sourceHash": "435edb7da5c539ff",
+            "liveHash": "435edb7da5c539ff",
+            "sourceLength": 13844,
+            "liveLength": 13844
+          },
+          {
+            "path": "styles.css",
+            "status": "match",
+            "httpStatus": 200,
+            "contentType": "text/css; charset=utf-8",
+            "sourceHash": "95574eda6090e34b",
+            "liveHash": "95574eda6090e34b",
+            "sourceLength": 21184,
+            "liveLength": 21184
+          },
+          {
+            "path": "app.mjs",
+            "status": "mismatch",
+            "httpStatus": 200,
+            "contentType": "text/javascript; charset=utf-8",
+            "sourceHash": "3f2c73f2754c2560",
+            "liveHash": "6a7a13a4b4e9a891",
+            "sourceLength": 67973,
+            "liveLength": 65664
+          }
+        ],
+        "mismatches": [
+          "app.mjs"
+        ],
+        "summary": "Deployment drift: live 16666 primary web assets differ from current source (app.mjs)."
+      }
+    },
+    {
+      "id": "live-browser-dom",
+      "status": "pass",
+      "summary": "Browser DOM confirms the default workbench, core controls, and outer scroll lock.",
+      "evidence": [
+        "title=HWLAB 云工作台",
+        "bodyOverflow=hidden",
+        "htmlOverflow=hidden",
+        "gateRouteAvailable=true",
+        "m3WiringRows=1",
+        "codeAgentPostAttempts=0"
+      ],
+      "observations": {
+        "title": "HWLAB 云工作台",
+        "bodyOverflow": "hidden",
+        "htmlOverflow": "hidden",
+        "workspaceHidden": false,
+        "gateHidden": true,
+        "helpHidden": true,
+        "diagnosticsHidden": null,
+        "outerScrollLocked": true,
+        "rootAfterScrollAttempt": {
+          "windowScrollY": 0,
+          "htmlScrollTop": 0,
+          "bodyScrollTop": 0
+        },
+        "labelsPresent": true,
+        "navLabelsPresent": true,
+        "defaultBackstageHidden": true,
+        "gateRouteAvailable": true,
+        "wiringHeaders": [
+          "源设备",
+          "源端口",
+          "接线盘",
+          "目标设备",
+          "目标端口",
+          "状态",
+          "证据来源",
+          "trace/evidence"
+        ],
+        "m3WiringRows": [
+          [
+            "res_boxsimu_1",
+            "DO1",
+            "hwlab-patch-panel",
+            "res_boxsimu_2",
+            "DI1",
+            "阻塞 BLOCKED",
+            "SOURCE / required M3 route",
+            "m3-route-required / waiting-for-dev-live"
+          ]
+        ],
+        "coreControlsVisible": {
+          "commandInput": true,
+          "commandSend": true,
+          "agentChatStatus": true,
+          "conversationList": true,
+          "hardwareList": true,
+          "wiringTab": true,
+          "recordsTab": true
+        },
+        "codeAgentPostGuard": {
+          "installed": true,
+          "blockedPath": "/v1/agent/chat",
+          "attemptedCount": 0,
+          "attempts": []
+        }
+      }
+    },
+    {
+      "id": "live-gate-route",
+      "status": "pass",
+      "summary": "Direct /gate route opens the internal diagnostics view without becoming the default workbench.",
+      "evidence": [
+        "pathname=/gate",
+        "gateHidden=false",
+        "diagnosticsTermsPresent=true",
+        "codeAgentPostAttempts=0"
+      ],
+      "observations": {
+        "pathname": "/gate",
+        "hash": "",
+        "title": "HWLAB 云工作台",
+        "workspaceHidden": true,
+        "gateHidden": false,
+        "helpHidden": true,
+        "diagnosticsTermsPresent": true,
+        "codeAgentPostGuard": {
+          "installed": true,
+          "blockedPath": "/v1/agent/chat",
+          "attemptedCount": 0,
+          "attempts": []
+        }
+      }
+    },
+    {
+      "id": "live-help-markdown-route",
+      "status": "pass",
+      "summary": "Desktop browser help route remains non-default, markdown-rendered, and scrollable.",
+      "evidence": [
+        "hash=#help",
+        "heading=云工作台内部使用说明",
+        "rootStillLocked=true",
+        "helpPanelScrolls=true",
+        "codeAgentPostAttempts=0"
+      ],
+      "observations": {
+        "hash": "#help",
+        "pathname": "/",
+        "helpState": "ready",
+        "workspaceHidden": true,
+        "gateHidden": true,
+        "helpHidden": false,
+        "heading": "云工作台内部使用说明",
+        "renderedLists": 26,
+        "codeCount": 37,
+        "hasRawMarkdownHeading": false,
+        "termsPresent": true,
+        "helpPanelScrolls": true,
+        "rootStillLocked": true,
+        "helpScroll": {
+          "before": 0,
+          "after": 836,
+          "clientHeight": 495,
+          "scrollHeight": 1331,
+          "overflowY": "auto"
+        },
+        "routeIsHashHelp": true,
+        "routeIsSlashHashHelp": false,
+        "routeIsDirectHelp": false,
+        "nonDefaultMarkdownHelp": true,
+        "codeAgentPostGuard": {
+          "installed": true,
+          "blockedPath": "/v1/agent/chat",
+          "attemptedCount": 0,
+          "attempts": []
+        }
+      }
+    },
+    {
+      "id": "live-code-agent-browser-journey",
+      "status": "not_applicable",
+      "summary": "DOM-only mode never posts the browser Code Agent journey; /v1/agent/chat is not sent.",
+      "evidence": [
+        "POST /v1/agent/chat not_applicable",
+        "POST /v1/agent/chat not sent",
+        "DOM-only read-only mode"
+      ],
+      "observations": {
+        "request": {
+          "method": "POST",
+          "status": "not_applicable",
+          "urlPath": "/v1/agent/chat"
+        },
+        "response": {
+          "status": "not_applicable",
+          "provider": "not_observed",
+          "model": "not_observed",
+          "backend": "not_observed",
+          "traceId": "not_observed",
+          "hasReply": false,
+          "error": null
+        },
+        "classification": {
+          "status": "not_applicable",
+          "reason": "dom_only_no_code_agent_post",
+          "codeAgentBrowserJourneySkipped": true
+        },
+        "networkEvents": []
+      }
+    }
+  ],
+  "blockers": [
+    {
+      "type": "observability_blocker",
+      "scope": "live-runtime-current-main",
+      "status": "open",
+      "summary": "Deployment drift: live API runtime commit/image tag does not match current source desired runtime identity."
+    },
+    {
+      "type": "observability_blocker",
+      "scope": "live-web-assets-current-main",
+      "status": "open",
+      "summary": "Deployment drift: live 16666 primary web assets differ from current source (app.mjs)."
+    }
+  ],
+  "safety": {
+    "prodTouched": false,
+    "servicesRestarted": false,
+    "heavyE2E": false,
+    "hardwareWriteApis": false,
+    "sourceIsDevLive": false,
+    "liveMode": "dom-only-readonly-no-code-agent-post",
+    "codeAgentBrowserJourneySkipped": true,
+    "codeAgentPostSent": false,
+    "retainedApiFields": [
+      "runtime.commitId",
+      "runtime.imageTag",
+      "web asset hash/status",
+      "DOM route/control/wiring observations"
+    ],
+    "statement": "DOM-only live smoke preserves runtime and web-asset identity preflight semantics, continues with read-only browser DOM/help inspection even when identity is blocked, and never posts /v1/agent/chat, reads Secret values, mutates live DEV, or claims M3/M4/M5 acceptance."
+  },
+  "artifacts": {
+    "reportPath": "/workspace/hwlab-d601-dom-only-feedback-validation/reports/dev-gate/dev-cloud-workbench-dom-only.json"
+  }
+}