部署公网并修正 live smoke 角色导航（05-30-deploy-mobile-public-audit）

.trellis/spec/hyb-oa/deployment-trialrun.md

@@ -110,6 +110,9 @@ SYNC_ENV=0 bash deploy/trialrun/deploy.sh
   `/portal` URL and the `今日任务` heading.
 - Navigation-label assertions for the workbench link must accept both `工作台`
   and `Portal` while older mocks still use English labels.
+- Navigation assertions must be role-aware. Admin/manager smoke may assert
+  team/admin entries such as `团队`, but ordinary employee smoke must not
+  require links that `NavLinks` intentionally hides for that role.
 - Smoke tests must not require a copy string that is not a product contract for
   public availability.
 - If the product intentionally renames the primary workbench label again, update
@@ -120,6 +123,8 @@ SYNC_ENV=0 bash deploy/trialrun/deploy.sh
 
 - Page reaches `/portal`, `今日任务` is visible, but nav label is `工作台` ->
   smoke should pass.
+- Employee reaches `/portal`, role-aware navigation hides `团队`, and employee
+  pages such as `项目` remain reachable -> smoke should pass.
 - Page reaches `/portal`, but `今日任务` is missing -> smoke should fail.
 - Page stays on login, `/403`, error fallback or another route -> smoke should
   fail.
@@ -130,10 +135,14 @@ SYNC_ENV=0 bash deploy/trialrun/deploy.sh
 
 - Good: `assertPortalLoaded` checks `/portal`, `今日任务`, and a workbench link
   matching either `工作台` or `Portal`.
+- Good: `assertMainNavVisible(page, { expectTeam: false })` is used for
+  ordinary employee live smoke.
 - Base: mocked E2E fixtures may still emit `Portal`; live public navigation may
   emit `工作台`.
 - Bad: live smoke hard-codes only `Portal` and blocks deployment after a valid
   Chinese navigation rollout.
+- Bad: employee live smoke requires the `团队` sidebar link after role-aware
+  navigation intentionally hides it.
 
 ### 6. Tests Required