diff --git a/README.md b/README.md
index dacbd56..d2ccbca 100644
--- a/README.md
+++ b/README.md
@@ -82,10 +82,12 @@ profile 的 `package.json`：
 
 | 模式 | 策略 | 说明 |
 |---|---|---|
-| 只读 | `allowedPackages` 哨兵值、`enableTransports=false`、`allowTransportableEdits=false`、`allowExecution=false`、`allowDebugger=false` | 安全基线 |
-| 调试 | 只读 + `allowExecution=true` + `allowDebugger=true` | 断点/单步/变量/栈 |
+| 只读 | `allowedPackages` 哨兵值、`allowTransportableEdits=false`、`allowExecution=false`、`allowDebugger=false`；`enableTransports=true`（**仅用于读**传输请求/版本） | 安全基线：可搜索/读源码/读传输请求与版本/数据预览，写与激活全部拒绝 |
+| 调试 | 只读 + `allowExecution=true` + `allowDebugger=true` | 额外允许执行触发断点、断点/单步/变量/栈；写与传输修改仍关闭 |
 | 更改 | `allowTransportableEdits=true`、`enableTransports=true`、`allowExecution=true`、`allowDebugger=true`、白名单 | 写前 diff、传输请求纪律 |
 
+> 说明：abap-adt 的 `enableTransports` 会把整个 transport 工具族（`adt_transports`、`adt_object_versions`、`adt_cochange`）一起关掉——这些在 0.12.2 里**都是只读工具**，所以只读/调试模式保持 `enableTransports=true`，真正拦写的是 `allowedPackages` 哨兵值 + `allowTransportableEdits=false`。
+
 - 模式切换**只在设置页**，会话里不提供开关（安全）；
 - 只读/调试下白名单不生效但会保留，切回更改时复用；
 - 白名单存在 `<workspace>/.dsh-abap-adt/ui-settings.json`（本插件私有，abap-adt 不会读取）。
diff --git a/client.js b/client.js
index 5d16789..a59bb3f 100644
--- a/client.js
+++ b/client.js
@@ -38,8 +38,8 @@ window.__ModuleLoader__.load({
         modeTitle: '运行模式（本工作区）',
         modes: { 'read-only': '只读', debug: '调试', change: '更改' },
         modeHints: {
-          'read-only': '只读：写/激活/删除/传输/执行/调试全部关闭，只做调查与补丁建议。',
-          debug: '调试：允许执行以触发断点，可用 adt_debug 设断点/单步/看变量；写与传输仍关闭。',
+          'read-only': '只读：写/激活/删除/执行/调试关闭；可搜索、读源码、读传输请求与版本、数据预览。',
+          debug: '调试：在只读基础上允许执行以触发断点，可用 adt_debug；写与传输修改仍关闭。',
           change: '更改：按白名单可写（含传输，每次写需给请求号），允许执行与调试器；写前先给用户看 diff。',
         },
         modeSwitched: '运行模式已切换',
@@ -101,8 +101,8 @@ window.__ModuleLoader__.load({
         modeTitle: 'Run mode (this workspace)',
         modes: { 'read-only': 'Read-only', debug: 'Debug', change: 'Change' },
         modeHints: {
-          'read-only': 'Read-only: writes, activation, deletion, transports, execution and the debugger are off; investigate and propose patches only.',
-          debug: 'Debug: execution is allowed to trigger breakpoints; adt_debug is available; writes and transports stay off.',
+          'read-only': 'Read-only: writes, activation, deletion, execution and the debugger are off; search, read source, READ transport requests/versions and preview data.',
+          debug: 'Debug: read-only plus execution to trigger breakpoints and adt_debug; writes and transport changes stay off.',
           change: 'Change: whitelisted packages are writable (transports need the request number on every write), execution and the debugger are allowed; show a diff before writing.',
         },
         modeSwitched: 'Run mode switched',
diff --git a/cordis.patch.yml b/cordis.patch.yml
index 3cbe236..2a4432d 100644
--- a/cordis.patch.yml
+++ b/cordis.patch.yml
@@ -167,21 +167,23 @@
             name: '@deepseek-ai/dsh-plugin-manager/tools'
             disabled: true
 # ============ ABAP 工具与安全基线（Read-Only baseline）============
-# 预设只带「安全基线」：写/激活/删除/传输/执行/调试全部关闭。
+# 预设只带「安全基线」：写/激活/删除/执行/调试关闭；传输只允许“读”
+# （adt_transports / adt_object_versions 是只读工具，enableTransports 只控制
+#  传输工具族与传输号校验，真正拦写的是 allowedPackages 哨兵值）。
 # 运行模式由工作区文件 <workspace>/.dsh-abap-adt/destinations.yaml 的 policy
 # 覆盖（该工作区内的目的地按工作区策略执行）：
-#   只读 = 继承本基线；调试 = allowExecution + allowDebugger；
-#   更改 = allowTransportableEdits + enableTransports + allowedPackages Z*,$TMP。
+#   只读 = 继承本基线（可读传输请求/版本）；调试 = + allowExecution + allowDebugger；
+#   更改 = allowTransportableEdits + allowedPackages 白名单 + allowDebugger。
 # 切换入口：设置 → ABAP ADT → 运行模式（写回工作区文件，立即生效）。
           - id: abap-adt
             name: '@nefevcore/abap-adt-dsh-plugin'
             config:
               demo: true
               defaultDestination: demo
-              enableTransports: false
+              enableTransports: true
               allowTransportableEdits: false
               allowedPackages: "__READ_ONLY_NO_PACKAGE__"
-              allowedTransports: "__READ_ONLY_NO_TRANSPORT__"
+              allowedTransports: "*"
               allowExecution: false
               allowBatchWrites: false
               allowDebugger: false
diff --git a/index.js b/index.js
index a156e8b..09b6e29 100644
--- a/index.js
+++ b/index.js
@@ -65,8 +65,12 @@ const ROUTE_PREFIX = '/abap-adt'
  */
 const MODE_POLICIES = {
   'read-only': {
-    enableTransports: false,
-    allowedTransports: '__READ_ONLY_NO_TRANSPORT__',
+    // Transport READS stay available in read-only mode: `enableTransports`
+    // gates the transport tool family (adt_transports / adt_object_versions —
+    // both read-only tools); writes are blocked by the package sentinel below
+    // plus allowTransportableEdits=false.
+    enableTransports: true,
+    allowedTransports: '*',
     allowTransportableEdits: false,
     allowedPackages: '__READ_ONLY_NO_PACKAGE__',
     allowExecution: false,
@@ -75,8 +79,10 @@ const MODE_POLICIES = {
     allowDebugVariables: false,
   },
   debug: {
-    enableTransports: false,
-    allowedTransports: '__READ_ONLY_NO_TRANSPORT__',
+    // Same transport-read exception as read-only; the debugger/execution are
+    // what this mode adds.
+    enableTransports: true,
+    allowedTransports: '*',
     allowTransportableEdits: false,
     allowedPackages: '__READ_ONLY_NO_PACKAGE__',
     allowExecution: true,
diff --git a/package.json b/package.json
index dc90b4a..fe10682 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "dsh-abap-workbench",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "private": false,
   "description": "SAP ABAP 工作台：一个 DSH bundle，内含 ABAP 预设（只读/调试/更改，按工作区策略切换）、可视化配置页（目的地、连接测试、运行模式、可写白名单）和会话状态徽章。依赖 @nefevcore/abap-adt-dsh-plugin 提供 adt_* 工具。",
   "type": "module",