docs: clarify HWLAB v0.2 closure validation

docs/reference/g14.md

@@ -90,7 +90,7 @@ The `--render web` proof must inspect the rendered body, not only the raw event
 
 CLI/Web-equivalent trace evidence does not replace browser UI evidence for visual, layout, copy-to-clipboard, collapsed-panel or removed-control bugs. Those require a bounded browser or DOM smoke against `http://74.48.78.17:19666/` after rollout, with assertions on the deployed page text, DOM state, or control behavior that the user reported. A local bundle smoke can support regression coverage, but the closeout still needs the deployed public endpoint unless the browser entry is unavailable and the issue comment records the blocker. Missing Playwright browser binaries or declared test dependencies are not a valid skip; install the repository-declared runner/browser or use an approved system browser executable and record that choice in the validation evidence.
 
-The closing comment for these issues must include the actual command or entry path, target lane or endpoint, relevant trace/session/thread/PipelineRun/run/device ids, and the pass/fail result. If the original entry cannot be verified because rollout has not happened, credentials are unavailable, the target runtime is down, or the required CLI capability is missing, keep the issue open and record the blocker. Do not close the issue on the strength of PR merge, targeted tests, or "will be verified after rollout" wording. If an issue was closed before this real CLI/user-entry validation, reopen it and add a correction comment before continuing.
+The closing comment for these issues must be semantic natural language before it lists evidence: state what the user-visible problem was, what changed, where it rolled out, and what original entry was rechecked. It must include the actual command or entry path, target lane or endpoint, relevant trace/session/thread/PipelineRun/run/device ids, and the pass/fail result. If the original entry cannot be verified because rollout has not happened, credentials are unavailable, the target runtime is down, or the required CLI capability is missing, keep the issue open and record the blocker. Do not close the issue on the strength of PR merge, targeted tests, or "will be verified after rollout" wording. If an issue was closed before this real CLI/user-entry validation, reopen it and add a correction comment before continuing.
 
 For HWLAB v0.2 Code Agent context-loss or multi-turn continuity issues, the minimum closeout is a real `hwlab-cli client agent` two-turn E2E from `G14:/root/hwlab-v02` or another approved G14 execution plane with locked runtime namespace/lane env. Submit the first turn, poll its result to completed, submit the second turn with the same explicit `conversationId`/`sessionId`/`threadId`, then capture `trace`/`inspect` evidence. Passing evidence must show the second turn used prior-turn context, and should include context attachment or run reuse labels such as `conversation-context:attached`, `agentrun:run:reused`, `agentrun:runner-job:reused`, plus the relevant run/command ids. Long verification evidence belongs in a separate `gh issue comment create --body-file` comment; lifecycle close comments stay short, as defined in `docs/reference/cli.md`.
 
@@ -140,15 +140,22 @@ A direct commit on `v0.2` (work that landed with `git commit` on the fixed repo
 
 The recovery is auditable: the original `git show` patch and the `cherry-pick` SHA both land in the PR diff, so the issue/PR trail still contains the exact same bytes that were first committed directly. This is a one-time corrective action; recurring direct commits on `v0.2` are a workflow regression and must be called out in the relevant issue or PR.
 
-### v0.2 CLI Verification Gap
+### v0.2 Cloud Web Runtime Layout Validation
 
-`v0.2` does not yet have a layout-browser smoke equivalent to `scripts/dev-cloud-workbench-layout-smoke.mjs`, which is hard-coded to the DEV `16666/16667` endpoints and refuses to validate against `19666/19667`. Until a v0.2-specific layout smoke exists, v0.2 closeout relies on the following three CLI surfaces:
+Cloud Web layout, status-panel, collapsed-control, and modal issues on `v0.2` need deployed browser evidence. Source checks and control-plane rollout are supporting evidence; they do not prove that the public `19666` page renders the fixed DOM.
 
-- `trans G14:/root/hwlab-v02/.worktree/<task> script -- 'cd web/hwlab-cloud-web && npm run check && npm run build'` for the static `web:check` (unit/contract tests, source/static layout contracts, dist freshness) and the local `web:build` (12 dist files verified fresh).
-- `bun scripts/cli.ts hwlab g14 control-plane status --lane v02` for the runtime + 19666/19667 + Argo + GitOps alignment summary.
-- Bounded direct probes against the public endpoints: `curl -fsS http://74.48.78.17:19666/`, `curl -fsS http://74.48.78.17:19666/app.js`, `curl -fsS http://74.48.78.17:19666/styles.css`, `curl -fsS http://74.48.78.17:19667/health/live`, plus `grep` over the returned HTML/JS for the new selector/id/text introduced by the change.
+Use these surfaces together:
 
-These three surfaces must be combined for closeout. A passing `web:check` does not prove the running browser, and a passing runtime status does not prove the new selector exists. Document the explicit `grep`/curl evidence in the issue closeout comment so the CLI gap is auditable. Adding a v0.2 layout smoke is a follow-up and must not block the current fix.
+- `trans G14:/root/hwlab-v02/.worktree/<task>/web/hwlab-cloud-web script -- 'bun run check'` for static unit/contract/layout checks and dist freshness.
+- `bun scripts/cli.ts hwlab g14 control-plane status --lane v02` for runtime, Argo, public endpoint, and GitOps alignment. If `origin/v0.2` moved through a parallel PR, use `--pipeline-run` or `--source-commit` and treat same-branch supersession as context rather than failure.
+- Public API probes for both `/health/live` and `/v1/live-builds`. `/health/live` proves live service health/revision, but Cloud Web build time, image tag/digest, source metadata, and actual runtime commit/revision should be read from `/v1/live-builds`.
+- A bounded browser/DOM probe against `http://74.48.78.17:19666/` that asserts the deployed page state relevant to the issue.
+
+For Workbench status/build panels, the minimum DOM proof should check the topbar chip, absence of full status cards in the right sidebar, hidden collapsed lists actually absent from layout, bounded scroll ownership on the right content area, and a details dialog that contains environment image metadata, actual live commit/revision, and source/build-time fields when available.
+
+`/v1/live-builds.latest` is global across services and can legitimately point at `hwlab-cloud-api` when API rolled after Web. Inspect the `hwlab-cloud-web` service row before deciding whether a Web build field is missing or stale.
+
+Generic layout smoke can be used only when it is bounded in the current transport. A Playwright smoke that runs through `trans` with no output for the SSH idle timeout, leaves preview/browser processes behind, or never writes an exit/report file is not closure evidence. Run it as an async remote job with explicit report and cleanup, or use a smaller issue-specific DOM probe that emits one JSON result and exits.
 
 ### v0.2 Cloud Web Button/JS Sync Rule (HWLAB #748)