docs: record browser verification

web/src/api/normalizers.test.mjs

@@ -1,5 +1,7 @@
 import test from 'node:test'
 import assert from 'node:assert/strict'
+import { readFile } from 'node:fs/promises'
+import { fileURLToPath } from 'node:url'
 
 import {
   formatConfidence,
@@ -92,6 +94,27 @@ test('empty agent and settings copy stay Chinese', () => {
   assert.ok(settings.every((item) => item.name !== 'Codex home'))
 })
 
+test('settings safety copy matches confirmed single-file writeback phase', async () => {
+  const thisFile = fileURLToPath(import.meta.url)
+  const viewPath = new URL('../views/SettingsView.vue', `file://${thisFile}`)
+  const source = await readFile(viewPath, 'utf8')
+
+  assert.doesNotMatch(source, /本阶段不会写回/)
+  assert.doesNotMatch(source, /不保存智能体 TOML/)
+  assert.match(source, /仅校验后单文件写回/)
+  assert.match(source, /不自动保存或批量写回/)
+})
+
+test('agent editor copy reflects preview and draft editing, not readonly-only mode', async () => {
+  const thisFile = fileURLToPath(import.meta.url)
+  const viewPath = new URL('../views/AgentView.vue', `file://${thisFile}`)
+  const source = await readFile(viewPath, 'utf8')
+
+  assert.doesNotMatch(source, /智能体只读编辑区/)
+  assert.doesNotMatch(source, /<p class="eyebrow">只读编辑区<\/p>/)
+  assert.match(source, /字段预览与草稿编辑区/)
+})
+
 test('normalizes empty runtime without falling back to fake real data', () => {
   const runtime = normalizeRuntime({
     items: [],

web/src/views/AgentView.vue

@@ -140,10 +140,10 @@ async function writeDraft() {
       </button>
     </aside>
 
-    <section class="panel editor-panel" aria-label="智能体只读编辑区">
+    <section class="panel editor-panel" aria-label="字段预览与草稿编辑区">
       <div class="panel-heading horizontal">
         <div>
-          <p class="eyebrow">只读编辑区</p>
+          <p class="eyebrow">字段预览与草稿编辑区</p>
           <h2>{{ selectedAgent?.name || '没有可显示的智能体' }}</h2>
         </div>
         <StatusBadge

web/src/views/SettingsView.vue

@@ -9,9 +9,9 @@ import { settings } from '../data'
       <div class="panel-heading horizontal">
         <div>
           <p class="eyebrow">设置</p>
-          <h2>只读配置摘要</h2>
+          <h2>安全配置摘要</h2>
         </div>
-        <StatusBadge label="接口只读" status="complete" source="计划文件" confidence="中" />
+        <StatusBadge label="配置受控" status="complete" source="计划文件" confidence="中" />
       </div>
 
       <div class="settings-list">
@@ -29,13 +29,14 @@ import { settings } from '../data'
     <aside class="panel">
       <div class="panel-heading">
         <p class="eyebrow">安全边界</p>
-        <h2>本阶段不会写回</h2>
+        <h2>仅校验后单文件写回</h2>
       </div>
       <ul class="safety-list">
         <li>不读取或展示 `.codex/auth.json`。</li>
         <li>不写入 Codex SQLite。</li>
-        <li>不保存智能体 TOML。</li>
-        <li>真实数据通过本阶段只读接口展示。</li>
+        <li>智能体 TOML 仅在校验、备份和确认后写回当前文件。</li>
+        <li>不自动保存或批量写回。</li>
+        <li>项目、运行线程和工作流仍通过只读接口展示。</li>
       </ul>
     </aside>
   </section>