test: add workbench dom-only live validation

docs/dev-acceptance-matrix.md

@@ -94,15 +94,20 @@ listed above.
 Cloud Web workbench smoke is covered by:
 
 - `node scripts/dev-cloud-workbench-smoke.mjs --static`
+- `node scripts/dev-cloud-workbench-smoke.mjs --dom-only --url http://74.48.78.17:16666/`
 - `node scripts/dev-cloud-workbench-smoke.mjs --live --url http://74.48.78.17:16666/`
 
 The static mode is SOURCE-level contract evidence only and must report
 `devLive=false`; it cannot promote SOURCE, LOCAL, DRY-RUN, or fixture evidence
 to DEV-LIVE. It observes the PR #114 Markdown help surface as ready when
 `web/hwlab-cloud-web/help.md`, the vendored `marked` renderer, and the
-non-default internal help route are present. The live mode is optional
-read-only HTTP plus browser DOM observation and must report `blocked` or `skip`
-structure instead of a false green when the browser check is unavailable.
+non-default internal help route are present. The `--dom-only` mode is a
+live-read-only DOM validation path: it preserves runtime/web-asset identity
+preflight semantics, may still inspect deployed DOM wiring after identity drift,
+and records Code Agent as `not_applicable` without sending `/v1/agent/chat`.
+The live mode is optional read-only HTTP plus browser DOM observation and must
+report `blocked` or `skip` structure instead of a false green when the browser
+check is unavailable.
 
 | Step | Probe | Success Criteria | Failure Criteria | Blocker Class |
 | --- | --- | --- | --- | --- |

docs/reference/cloud-workbench.md

@@ -78,6 +78,7 @@ heavier browser run:
 node web/hwlab-cloud-web/scripts/check.mjs
 node web/hwlab-cloud-web/scripts/build.mjs
 node scripts/dev-cloud-workbench-smoke.mjs --static
+node scripts/dev-cloud-workbench-smoke.mjs --dom-only --url http://74.48.78.17:16666/
 ```
 
 The static smoke checks both sides of the route contract: `/` remains the
@@ -89,6 +90,13 @@ Live checks against `http://74.48.78.17:16666/` are read-only and must report
 blocked/skip instead of false green when the browser or network path is not
 available.
 
+`--dom-only` keeps the runtime and web-asset identity preflight checks, then
+continues with read-only DOM/help validation for the deployed workbench even
+when identity drift blocks the full journey. It never sends `POST
+/v1/agent/chat`; the Code Agent journey is recorded as `not_applicable` and
+must not be used as a DEV-LIVE reply, Secret, mutation, or M3/M4/M5 acceptance
+claim.
+
 ## Stable Sources
 
 - [pikasTech/HWLAB#99](https://github.com/pikasTech/HWLAB/issues/99): default

docs/reference/code-agent-chat-readiness.md

@@ -60,10 +60,13 @@ Workbench 静态接线检查：
 
 ```sh
 node scripts/dev-cloud-workbench-smoke.mjs --static
+node scripts/dev-cloud-workbench-smoke.mjs --dom-only --url http://74.48.78.17:16666/
 ```
 
 该命令验证 Workbench 默认页、同源只读边界和 `/v1/agent/chat` 前端主流程接线。它只产出
-`SOURCE` 级证据。
+`SOURCE` 级证据。`--dom-only` 会保留部署 runtime/web-asset identity preflight，
+但只做真实 DEV DOM/help 只读观察；它不会发送 `/v1/agent/chat`，Code Agent journey
+必须记录为 `not_applicable`，不能冒充真实 DEV-LIVE reply。
 
 授权凭证注入后的真实 DEV 复测：