diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 8fd58f4..f10bc70 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -38,5 +38,17 @@ jobs:
       - name: Check disk usage parsing and install safeguards
         shell: pwsh
         run: ./tests/created-disk-usage.ps1
+      - name: Check the manager requirement, port_base check and game port guard
+        shell: pwsh
+        run: ./tests/tooling-guards.ps1
+      - name: Check how the r1999 item judges the M9A driver
+        shell: pwsh
+        run: ./tests/m9a-verdict.ps1
+      - name: Check that test roots are existing roots and never the production root
+        shell: pwsh
+        run: ./tests/root-guards.ps1
+      - name: Check that pointing a test root at the SDK under test is undone byte for byte
+        shell: pwsh
+        run: ./tests/root-sdk.ps1
       - name: Scan tracked files for private identity and paths
         run: python3 .modavd/scripts/privacy.py .
diff --git a/README.en.md b/README.en.md
index 0c3995e..b0ceaa5 100644
--- a/README.en.md
+++ b/README.en.md
@@ -21,7 +21,7 @@ and the bundled scripts in `package/` and the bridge in `bridge/` of the ModAVD
 - **Use newly created test instances logged in with test accounts.** Do not run on an instance logged in with your main account: several items create instances, delete instances and force-stop the game.
 - adb uses only private ports. It does not touch 5037, and it does not touch 20049 / 20050 of the production root folder. Every instance is shut down with `adb shell sync` first.
 - When the test machine also has a production root folder, set `portBase` in the test root's `mas-avd.json` (for example 21000; needs a manager with ModAVD/ModAVD#75),
-  so that its instances do not share ports with the production instances of the same number. The root folders that `upgrade` and `ime-pkg` build themselves write 23000 by default.
+  so that its instances do not share ports with the production instances of the same number. The regression creates no root folders (since 11-05): instances go into the existing test roots under `E:\testbed`, and `upgrade` and `ime-pkg` also first install the package into `PackageRoot` (or `TestRoot`), create a temporary instance there and delete only that instance afterwards. The production root folder `D:\ModAVD`, the root folders listed in the local setting `ProductionRoots` (list the root you use yourself every day there too), and the production adb ports 5037 / 20049 / 20050 are refused as test root, output, work or instance folder. When the local configuration sets `TestRoots`, only the test roots listed there are accepted.
   Every item takes the serial and the ports from `modavd info --json` instead of computing `20000 + 10 × index` itself.
 - Problems and suggestions go to the [Issues](https://github.com/ModAVD/ModAVD/issues) of the ModAVD repository; pick "Pre-release regression". This repository only takes PRs.
 
@@ -42,15 +42,17 @@ pwsh -NoProfile -File regress.ps1 -Suite suites\release.psd1 -Scope emulator -Sd
 
 **Frame rate of the game items**: by default `items\game-real.ps1` runs only the round with the bridge installed, and the median frame rate is compared with `baselines\fps.json` (the numbers of the previous production version, with a tolerance for each game).
 `items\yys.ps1` compares the courtyard and each battle with it too (`yys-courtyard`, `yys-battle`). When the same machine runs more than 2 other emulators, it only records the number and does not judge it.
+**The Reverse: 1999 item** (`-Game r1999`) has M9A play a resource stage of the regular combat task (常规作战), to measure the frame rate in battle. Whether it eats candy when stamina runs out is set by `-M9ACandy <times>` (default 0, no candy). If the combat task ends within 2 minutes without being stopped by the time budget, nothing was fought and the item fails (the smart balanced farming task of M9A 4.11.1 reports success without fighting at all, so it is no longer used since 11-05).
+
 The baseline records whether CPU boost (turbo) was on when it was measured (`condition`: `睿频开` on, `睿频关` off). During a run this is read from the host CPU's "processor performance" counter (above 101 % means boost is on). When this run's condition is worse than the baseline's (boost off against a boost-on baseline) or cannot be read, the number is only recorded, not judged; when it is better, it is judged as usual, since boost only raises the frame rate.
 After each release regression passes, write this version's numbers and condition back to `fps.json`.
 
-By default the output goes to `<TempRoot>\regress-<build>-<time>\` (when the local configuration has `TempRoot`, `-Out` must also be under it): the console output of each item `<item>.console.txt`,
+By default the output goes to `<TempRoot>\regress-<build>-<time>\` (`-Out` can be anywhere except under the production root folder): the console output of each item `<item>.console.txt`,
 the item's own output `<item>\`, the overall log `regress.log`, `results.json` and `results.md`. If any item is not "passed", the exit code is 1.
 The start of the log records which build was tested: the hash of the manager's CLI, the commit of the repository that holds the bundled scripts, and the commit of this repository.
 
-`-Manager` is the folder that holds `tools\modavd.exe` and `ModAVD.exe` (the `build.ps1 -Out` of ModAVDManager, or an unpacked release package). For the release regression, use the build that is going to ship in the package.
-`-PackageScripts` is the `package\` of the ModAVD repository; for the release regression, use the one in the release clone. Both can go into the local configuration.
+`-Manager` is the folder that holds `tools\modavd.exe` and `ModAVD.exe` (the `build.ps1 -Out` of ModAVDManager, or an unpacked release package). For the release regression, use the build that is going to ship in the package. It is **required** and is not read from the local configuration: an old manager does not know the `portBase` in the test root's `mas-avd.json` and would start the test root's instances on the production 20000 range. When running a single item on its own, set the environment variable `MODAVD_REGRESS_MANAGER`. Before starting an instance of the test root, the items run `modavd list --json` and check that `port_base` exists (ModAVDManager 0.3.1 and later), matches `portBase`, and is not 20000.
+`-PackageScripts` is the `package\` of the ModAVD repository; for the release regression, use the one in the release clone. It can go into the local configuration.
 
 ## Local configuration
 
@@ -62,11 +64,14 @@ The suite refers to keys with `{Local:<key>}`, and the item scripts take their d
 | Key | What it is | Used by |
 | --- | --- | --- |
 | `TempRoot` | The root folder for temporary output | runner, all items |
-| `Manager` | The folder that holds `tools\modavd.exe` and `ModAVD.exe` | runner, all items |
+| `GamePorts` | The console ports of the game instances; defaults are ark 20072, r1999 20100, sr 20120, ef 20096; override with `@{ sr = 20130 }`. A port inside the production 20000-20049 range, or touching 5037, 20049 or 20050, stops with an error | game-real |
+| `GameAvds` | The names of the game instances; defaults are ark `mas_6`, r1999 `mas_7`, sr `gfx_t2`, ef `endfield`. Instances in the testbed roots are named `mas_<number>`; override with `@{ r1999 = 'mas_1' }`. An instance folder (`GameAvdHome` / `SrAvdHome`) under a production root folder stops the run | game-real |
 | `PackageScripts` | The `package\` of the ModAVD repository (the bridge install script `modavd-bridge.ps1` is in it) | runner, bridge, upgrade, game-real |
-| `TestRoot` | The ModAVD root folder used for testing (private adb port, and `portBase` when the machine also has a production root folder; instance 0 has the bridge installed and is logged in with the *Onmyoji* test account; the other numbers are created temporarily and deleted after the run) | bridge, bridge-default, datadisk, yys |
+| `ProductionRoots` | Root folders the tests never touch, in addition to `D:\ModAVD` (not instead of it): list the root you use yourself every day here too. A test root, output, work or instance folder under them stops the run | runner, all items |
+| `TestRoots` | The only test roots the regression may use (optional): when set, only the listed root folders themselves are accepted, and a `TestRoot`, `PackageRoot` or `-Root` pointing elsewhere stops the run | runner, all items |
+| `TestRoot` | The ModAVD root folder used for testing: the existing flow-a / flow-b under `E:\testbed`; a folder that is not an existing root (no `mas-avd.json`), or whose `mas-avd.json` does not set its own `adbServerPort` and `scriptAdbServerPort`, stops the run, none is created (`portBase` when the machine also has a production root folder; instance 0 has the bridge installed and is logged in with the *Onmyoji* test account; the other numbers are created temporarily and deleted after the run) | bridge, bridge-default, datadisk, yys |
+| `PackageRoot` | The test root for the items that install a package (`TestRoot` when not set): it is turned into the package under test first and stays on the new package afterwards | upgrade, ime-pkg |
 | `PrevPackage` | The package staging folder of the previous production version (a fixed copy) | upgrade |
-| `OfficialSdk` | The official SDK (`platform-tools`, `system-images`); the newly built root folder links to it, in place of the download of "fetch the Google components" | upgrade, ime-pkg |
 | `Launcher` | The launcher `avd-p0.ps1` (starts an AVD headless or windowed, with parameters such as `-AdbPort` and `-VulkanFix`) | game-real, ime |
 | `Monitor` | The sampling script `emu_monitor.py` (one line every 30 s: frame rate, restarts, crashes, ANRs, Vulkan errors) | game-real |
 | `VulkanFixLib` | The guest Vulkan fix library | game-real |
@@ -125,7 +130,7 @@ In the game UI, do only fixed operations such as "launch" and "tap Enter Game".
 | ark / r1999 / sr / ef | `items\game-real.ps1` | A 15-minute real run of each game with its own automation scripts (the round with the bridge installed), with the frame rate compared with `baselines\fps.json` |
 | bridge | `items\bridge.ps1` | The whole flow of installing / uninstalling the bridge (Windows PowerShell 5.1); it creates instance 6 and deletes it after the run |
 | datadisk | `items\datadisk.ps1` | The inode cap on a new disk and growing with `set --data-gb`; it creates instance 3 and deletes it after the run |
-| upgrade | `items\upgrade.ps1` | Builds a root folder from the previous release package, creates an instance and writes data, overlays the new package following "How to update", then checks boot, data, growing the disk, and that a normal boot installs the bridge automatically. When `-Next` is a package staging folder (with `components\modavd-ime.apk`), it also checks that the host IME came with the package, that the installed one is the officially signed one, and that it is set as the default (not checked when `-Next` is an SDK). The root folder is deleted after the run |
+| upgrade | `items\upgrade.ps1` | Installs the previous release package into `PackageRoot` following the package manifests, creates a temporary instance and writes data, overlays the new package following "How to update", then checks boot, data, growing the disk, and that a normal boot installs the bridge automatically. When `-Next` is a package staging folder (with `components\modavd-ime.apk`), it also checks that the host IME came with the package, that the installed one is the officially signed one, and that it is set as the default (not checked when `-Next` is an SDK). Afterwards the temporary instance is deleted and the root folder stays on the new package |
 | yys | `items\yys.ps1` | *Onmyoji* cold-boots into the game and the frame rate is measured (instance 0 of the test root, bridge installed, already logged in); then MaaYYs (`items\maayys_run.py`) really fights Mitama battles |
 | ef-ab | `items\ef-ab.ps1` | *Arknights: Endfield* cold boots, alternating new and old builds; it measures only when the host is idle |
 
@@ -135,7 +140,7 @@ For the opt-in measurement of a newly created data disk and inode use before and
 
 | Item | Script | Notes |
 | --- | --- | --- |
-| ime-pkg | `items\ime-pkg.ps1` | `-Package <package staging folder>` (`release\ModAVD-<version>-win-x64`, read-only): copies it as a root folder and creates instance 9, checks that the officially signed IME is installed automatically on boot and set as the default, runs the 20 channel checks windowed, then checks that a development-signed IME is replaced by the officially signed one and that the steady state does not change. The root folder is deleted after the run, and the log is kept under `-Work` |
+| ime-pkg | `items\ime-pkg.ps1` | `-Package <package staging folder>` (`release\ModAVD-<version>-win-x64`, read-only): installs it into `PackageRoot` following the package manifests and creates temporary instance 9, checks that the officially signed IME is installed automatically on boot and set as the default, runs the 20 channel checks windowed, then checks that a development-signed IME is replaced by the officially signed one and that the steady state does not change. Afterwards the temporary instance is deleted, the root folder stays on this package, and the log is kept under `-Work` |
 
 ## When there is a dedicated test machine
 
diff --git a/README.md b/README.md
index a043b2f..0515ba8 100644
--- a/README.md
+++ b/README.md
@@ -21,7 +21,7 @@ ModAVD 仓库里的随包脚本 `package/` 和执行桥 `bridge/`，所以单独
 - **测试实例用新建的、登测试号的**，不要拿登着主力账号的实例来跑：有几项会建实例、删实例、强停游戏。
 - adb 只用私有端口，不碰 5037，也不碰生产根目录的 20049 / 20050；关实例一律先 `adb shell sync` 再关。
 - 测试机上同时有生产根目录时，测试根要在 `mas-avd.json` 里设 `portBase`（比如 21000，要管理器带 ModAVD/ModAVD#75），
-  实例的端口就不和生产的同编号实例撞；`upgrade`、`ime-pkg` 自己搭的根目录默认写 23000。各项的 serial 和端口都从
+  实例的端口就不和生产的同编号实例撞。回归不新建根目录（11-05 起）：实例都建在 `E:\testbed` 下已有的测试根里，`upgrade`、`ime-pkg` 也是在 `PackageRoot`（没有就 `TestRoot`）上先装包、建临时实例，测完只删实例。生产根目录 `D:\ModAVD`、本机配置 `ProductionRoots` 另列的根目录（你自己日常在用的根也写进去），以及生产的 adb 端口 5037 / 20049 / 20050，当测试根、输出、工作目录、实例目录一律拒绝；本机配置写了 `TestRoots` 时，测试根只认列出来的那几个。各项的 serial 和端口都从
   `modavd info --json` 取，不自己按 `20000 + 10 × 编号` 算。
 - 问题和建议到 ModAVD 仓库的 [Issues](https://github.com/ModAVD/ModAVD/issues) 提，选上「发版前回归」；本仓库只收 PR。
 
@@ -42,15 +42,17 @@ pwsh -NoProfile -File regress.ps1 -Suite suites\release.psd1 -Scope emulator -Sd
 
 **游戏项帧率**：`items\game-real.ps1` 默认只跑装桥那一轮，帧率中位数和 `baselines\fps.json`（上一个生产版的数，每个游戏有容差）比；
 `items\yys.ps1` 的庭院和每场战斗也和它比（`yys-courtyard`、`yys-battle`）。同机别的模拟器多于 2 个时只记录不判。
+**1999 那一项**（`-Game r1999`）让 M9A 打「常规作战」的资源本，测战斗里的帧率。体力不够时吃不吃糖由 `-M9ACandy <次数>` 定（默认 0，不吃）；常规作战不到 2 分钟就结束、又不是到时间停的，算没打到战斗、不通过（M9A 4.11.1 的「智能均衡刷材料」什么都不打就「成功」退出，11-05 起不用）。
+
 基准记着测的时候睿频开没开（`condition`）：测的时候按宿主 CPU 的「处理器性能」判（超过 101 % 就是开着）。这次条件比基准差（睿频关对睿频开的基准）或者判不出时只记录不判；比基准好照判，睿频只会让帧率更高。
 每次发版回归通过后，把这一版的数和条件写回 `fps.json`。
 
-输出默认在 `<TempRoot>\regress-<构建>-<时间>\`（本机配置有 `TempRoot` 时 `-Out` 也必须在它下面）：每项的控制台 `<项>.console.txt`、
+输出默认在 `<TempRoot>\regress-<构建>-<时间>\`（`-Out` 放哪都行，只是不能在生产根目录下）：每项的控制台 `<项>.console.txt`、
 项目自己的输出 `<项>\`、总日志 `regress.log`、`results.json` 和 `results.md`。有一项不是「通过」，退出码就是 1。
 日志开头记下测的是哪一版：管理器命令行的哈希、随包脚本所在仓库的提交、本仓库的提交。
 
-`-Manager` 是放着 `tools\modavd.exe` 和 `ModAVD.exe` 的目录（ModAVDManager 的 `build.ps1 -Out`，或解开的 Release 包），发版回归用要随包发的那一版；
-`-PackageScripts` 是 ModAVD 仓库的 `package\`，发版回归用发版克隆里的那份。两个都能写进本机配置。
+`-Manager` 是放着 `tools\modavd.exe` 和 `ModAVD.exe` 的目录（ModAVDManager 的 `build.ps1 -Out`，或解开的 Release 包），发版回归用要随包发的那一版。**必须给**，不从本机配置取：旧版管理器不认测试根 `mas-avd.json` 的 `portBase`，会把测试根的实例开到生产的 20000 段上。单独跑某一项时设环境变量 `MODAVD_REGRESS_MANAGER`。开测试根的实例之前，各项会先跑 `modavd list --json` 核对：要有 `port_base`（ModAVDManager 0.3.1 起），和 `portBase` 一致，且不是 20000。
+`-PackageScripts` 是 ModAVD 仓库的 `package\`，发版回归用发版克隆里的那份，能写进本机配置。
 
 ## 本机配置
 
@@ -62,11 +64,14 @@ pwsh -NoProfile -File regress.ps1 -Suite suites\release.psd1 -Scope emulator -Sd
 | 键 | 是什么 | 谁用 |
 | --- | --- | --- |
 | `TempRoot` | 临时输出的根目录 | 运行器、各项 |
-| `Manager` | 放着 `tools\modavd.exe`、`ModAVD.exe` 的目录 | 运行器、各项 |
+| `GamePorts` | 游戏实例的控制台端口，默认 ark 20072、r1999 20100、sr 20120、ef 20096，写成 `@{ sr = 20130 }` 覆盖；落在生产的 20000–20049 或碰 5037、20049、20050 就报错停下 | game-real |
+| `GameAvds` | 游戏实例的名字，默认 ark `mas_6`、r1999 `mas_7`、sr `gfx_t2`、ef `endfield`；testbed 的根里实例按编号叫 `mas_<号>`，写成 `@{ r1999 = 'mas_1' }` 覆盖。实例目录（`GameAvdHome` / `SrAvdHome`）在生产根目录下就停 | game-real |
 | `PackageScripts` | ModAVD 仓库的 `package\`（装桥脚本 `modavd-bridge.ps1` 在里面） | 运行器、bridge、upgrade、game-real |
-| `TestRoot` | 测试用的 ModAVD 根目录（私有 adb 端口，同机有生产根目录时设 `portBase`；0 号已装桥、登着阴阳师测试号，其余编号临时建、跑完删） | bridge、bridge-default、datadisk、yys |
+| `ProductionRoots` | 测试不碰的根目录，在 `D:\ModAVD` 之外再加（不是替换它）：你自己日常在用的根也写进来。测试根、输出、工作目录、实例目录在它们下面就停 | 运行器、各项 |
+| `TestRoots` | 回归只许用的测试根（可以不写）：写了就只认列出来的根目录本身，`TestRoot`、`PackageRoot`、`-Root` 指到别处就停 | 运行器、各项 |
+| `TestRoot` | 测试用的 ModAVD 根目录：`E:\testbed` 下已有的 flow-a / flow-b（`mas-avd.json` 里要写自己的 `adbServerPort`、`scriptAdbServerPort` 和 `portBase`；0 号已装桥、登着阴阳师测试号，其余编号临时建、跑完删）。不是已有根目录（没有 `mas-avd.json`）、没写这两个 adb 端口就停，不新建 | bridge、bridge-default、datadisk、yys |
+| `PackageRoot` | 装包类的项用的测试根（不写就用 `TestRoot`）：先装成要测的包，测完根目录停在新包上 | upgrade、ime-pkg |
 | `PrevPackage` | 上一个生产版的组包目录（固定副本） | upgrade |
-| `OfficialSdk` | 官方 SDK（`platform-tools`、`system-images`），新搭的根目录链到它，代替「补全组件」的下载 | upgrade、ime-pkg |
 | `ComponentCache` | 放着 `platform-tools_r37.0.1-win.zip`、`x86_64-34_r14.zip` 的目录（可以没有：没有就从网上下载一次） | fetch |
 | `Launcher` | 启动器 `avd-p0.ps1`（无头 / 带窗口开 AVD，带 `-AdbPort`、`-VulkanFix` 等参数） | game-real、ime |
 | `Monitor` | 采样脚本 `emu_monitor.py`（30 秒一行：帧率、重启、崩溃、ANR、Vulkan 报错） | game-real |
@@ -126,7 +131,7 @@ REGRESS-RESULT {"pass":true,"summary":"到登录页 41 秒；进游戏后 52.7 f
 | ark / r1999 / sr / ef | `items\game-real.ps1` | 各游戏自己的自动化脚本实跑 15 分钟（装桥那轮），帧率和 `baselines\fps.json` 比 |
 | bridge | `items\bridge.ps1` | 执行桥装 / 卸全流程（Windows PowerShell 5.1），新建 6 号实例跑完删掉 |
 | datadisk | `items\datadisk.ps1` | 新盘 inode 封顶、`set --data-gb` 扩容，新建 3 号实例跑完删掉 |
-| upgrade | `items\upgrade.ps1` | 用上一版正式包搭根目录、建实例写数据，照「怎么更新」覆盖新包后核对开机、数据、扩容、照常开机自动装桥；`-Next` 是组包目录（带 `components\modavd-ime.apk`）时还核对宿主输入法跟着包过来、装上的是正式签名那份并设为默认（`-Next` 是 SDK 时不查）；根目录跑完删掉 |
+| upgrade | `items\upgrade.ps1` | 在 `PackageRoot` 上先按包根清单装回上一版正式包、建临时实例写数据，照「怎么更新」覆盖新包后核对开机、数据、扩容、照常开机自动装桥；`-Next` 是组包目录（带 `components\modavd-ime.apk`）时还核对宿主输入法跟着包过来、装上的是正式签名那份并设为默认（`-Next` 是 SDK 时不查）；跑完删临时实例，根目录停在新包上 |
 | yys | `items\yys.ps1` | 阴阳师冷启动进游戏测帧（测试根的 0 号，已装桥、已登录），再用 MaaYYs（`items\maayys_run.py`）真打御魂 |
 | ef-ab | `items\ef-ab.ps1` | 终末地冷启动新旧交替，等宿主空闲才测 |
 
@@ -136,7 +141,7 @@ REGRESS-RESULT {"pass":true,"summary":"到登录页 41 秒；进游戏后 52.7 f
 
 | 项 | 脚本 | 说明 |
 | --- | --- | --- |
-| ime-pkg | `items\ime-pkg.ps1` | `-Package <组包目录>`（`release\ModAVD-<版本>-win-x64`，只读）：复制成根目录、新建 9 号实例，核对正式签名的输入法开机自动装好、设为默认，带窗口跑通道 20 项，再核对开发签名的换成正式签名、稳态不变；根目录跑完删掉，日志留在 `-Work` 下 |
+| ime-pkg | `items\ime-pkg.ps1` | `-Package <组包目录>`（`release\ModAVD-<版本>-win-x64`，只读）：按包根清单装进 `PackageRoot`、新建 9 号临时实例，核对正式签名的输入法开机自动装好、设为默认，带窗口跑通道 20 项，再核对开发签名的换成正式签名、稳态不变；跑完删临时实例，根目录停在这个包上，日志留在 `-Work` 下 |
 | fetch | `items\fetch.ps1` | `-Package <组包目录>`（只读）：搭两个只够补全组件用的新根目录，一个跑 `tools\modavd.exe components fetch`，一个用重定向的输入跑「补全组件.bat」（新版先选下载源，回车是自动；再同意许可协议），两样都要装好，再跑一次 `fetch` 都算齐全；新版批处理还要把下载源记成 `auto`。只有取许可协议清单要联网，`-Cache`（本机配置 `ComponentCache`）给了放着两个 zip 的目录时不下载，没给时命令行那遍下载一次、批处理那遍用它留下的 zip；不开模拟器；根目录跑完删掉 |
 
 ## 以后有了专门跑测试的机器
diff --git a/docs/created-disk-usage.md b/docs/created-disk-usage.md
index 9c34dcb..0a58c28 100644
--- a/docs/created-disk-usage.md
+++ b/docs/created-disk-usage.md
@@ -1,9 +1,9 @@
 # Measure a new data disk
 
-This opt-in Windows measurement uses a fresh root and a local game APK. It is not part of the release suite. Use a verified release package, an SDK with `platform-tools` and `system-images`, and a new `Work` path. The script copies the package and SDK components into that path. Choose an unused port range; do not run other tests on the instance.
+This opt-in Windows measurement creates a new instance in an existing test root (`E:\testbed\flow-a` or `flow-b`, or the local setting `TestRoot`) and uses a local game APK. It is not part of the release suite. Since 11-05 no root folders are built outside the testbed: the root must already exist (it has a `mas-avd.json`), must not be under the production root `D:\ModAVD` or a root listed in the local setting `ProductionRoots`, must be one of `TestRoots` when that is set, must set its own `adbServerPort` and `scriptAdbServerPort`, and must already be on the package to measure; pass that package with `-Package` to have its version checked. `Work` is a new path that only holds `measurement.json`. Pick a free instance number with `-Index` (default 7); the ports come from the root. Do not run other tests on the instance.
 
 ```powershell
-pwsh -NoProfile -File items/created-disk-usage.ps1 -Action Create -Work <new-path> -Package <unpacked-release> -OfficialSdk <sdk> -PortBase 27300 -AdbPort 27383 -ScriptAdbPort 27384 -DataGB 64
+pwsh -NoProfile -File items/created-disk-usage.ps1 -Action Create -Work <new-path> -Root E:\testbed\flow-a -Package <unpacked-release> -Index 7 -DataGB 64
 pwsh -NoProfile -File items/created-disk-usage.ps1 -Action Install -Work <new-path> -Apk <game.apk> -Game <game-name> -PackageId <android-package-id>
 ```
 
@@ -20,4 +20,4 @@ pwsh -NoProfile -File items/created-disk-usage.ps1 -Action Stop -Work <new-path>
 
 `measurement.json` contains timestamps, package version, configured data disk size, qcow2 file length, Windows file allocation, virtual disk size, and each `/data` sample. `spaceKiB` is in 1,024-byte units; inode values are counts. Allocation can differ from file length for sparse or compressed files. Neither is the virtual capacity. Record the package archive checksum and the actual game version separately, and describe the observed resource-download stage rather than assuming that an APK includes all resources.
 
-Keep the root and output for inspection. Stop only this instance and its private adb servers when finished. The script never deletes the root. Do not publish the APK, downloaded resources, or instance data.
+Keep the output for inspection. When finished, stop the instance and delete it with `modavd delete <index>` in that root; the script never deletes the root or other instances. Do not publish the APK, downloaded resources, or instance data.
diff --git a/items/bridge-default.ps1 b/items/bridge-default.ps1
index 5d3cd89..a6e30ac 100644
--- a/items/bridge-default.ps1
+++ b/items/bridge-default.ps1
@@ -13,7 +13,7 @@ param(
 )
 $ErrorActionPreference = 'Stop'
 . "$PSScriptRoot\common.ps1"
-$Root = Use-Local TestRoot $Root '-Root'
+$Root = Resolve-TestRoot (Use-Local TestRoot $Root '-Root')
 $script:Root = $Root; $script:Index = $Index
 $problems = @(); $notes = @(); $created = $false
 $marker = Join-Path $Root "avd\mas_$Index.avd\modavd-writable-system"
diff --git a/items/bridge.ps1 b/items/bridge.ps1
index 8df0cee..bef9d13 100644
--- a/items/bridge.ps1
+++ b/items/bridge.ps1
@@ -18,7 +18,7 @@ param(
 $ErrorActionPreference = 'Stop'
 [cultureinfo]::CurrentCulture = [cultureinfo]::InvariantCulture
 . "$PSScriptRoot\common.ps1"
-$Root = Use-Local TestRoot $Root '-Root'
+$Root = Resolve-TestRoot (Use-Local TestRoot $Root '-Root')
 if (-not $BridgeScript) { $BridgeScript = Join-Path (Get-PackageScripts) 'modavd-bridge.ps1' }
 $payload = Join-Path $Sdk 'emulator\resources\modavd'
 
diff --git a/items/common.ps1 b/items/common.ps1
index d212df8..256a9e6 100644
--- a/items/common.ps1
+++ b/items/common.ps1
@@ -1,10 +1,19 @@
 # 各项脚本共用（. "$PSScriptRoot\common.ps1"）：测试根换 SDK、调 modavd、私有 adb、结果行、本机配置（local.ps1）。
 # 开关机一律走测试根自己的 tools\modavd.exe：开机后的设置和产品一样，关机先正常关机、不成再 sync 后结束。
 . (Join-Path $PSScriptRoot '..\local.ps1')
+. (Join-Path $PSScriptRoot 'port-guard.ps1')
 
-# 管理器和随包脚本：regress.ps1 的 -Manager / -PackageScripts 经环境变量传下来；单独跑某一项时取本机配置的
-# Manager（放着 tools\modavd.exe 和 ModAVD.exe 的目录）和 PackageScripts（ModAVD 仓库的 package\）。用到时还没有就报错。
-$script:ManagerDir = Use-Local Manager $env:MODAVD_REGRESS_MANAGER '-Manager（regress.ps1）' -Optional
+# 管理器和随包脚本：regress.ps1 的 -Manager / -PackageScripts 经环境变量传下来。随包脚本单独跑某一项时可以取本机配置的
+# PackageScripts（ModAVD 仓库的 package\）；管理器（放着 tools\modavd.exe 和 ModAVD.exe 的目录）不取本机配置，只认
+# MODAVD_REGRESS_MANAGER：本机留着的旧管理器不认 portBase，会把测试根的实例开到生产的端口段上。用到时还没有就报错，
+# 不用管理器的项（比如不碰测试根的）不受影响。
+$script:ManagerDir = $env:MODAVD_REGRESS_MANAGER
+function Get-ManagerDir {
+    if (-not $script:ManagerDir) {
+        throw '没有管理器：单独跑某一项时，先把环境变量 MODAVD_REGRESS_MANAGER 设成发版用的那个管理器目录（放着 tools\modavd.exe 和 ModAVD.exe，即解开的 ModAVDManager Release 包或 build.ps1 -Out）。不从本机配置取，旧版管理器不认 portBase，会把测试根的实例开到生产的 20000 段上'
+    }
+    $script:ManagerDir
+}
 $script:PackageScripts = Use-Local PackageScripts $env:MODAVD_REGRESS_PACKAGE '-PackageScripts（regress.ps1）' -Optional
 function Get-PackageScripts { Use-Local PackageScripts $script:PackageScripts '-PackageScripts（regress.ps1）' }
 
@@ -12,11 +21,10 @@ function Get-PackageScripts { Use-Local PackageScripts $script:PackageScripts '-
 # 旧的命令行。内容一样就不动。
 function Sync-RootTools([string]$Root) {
     # 一行一对（前面的逗号让每对保持成一个数组，不被拆开）
+    $manager = Get-ManagerDir
     $pairs = @(
-        if ($script:ManagerDir) {
-            , @((Join-Path $script:ManagerDir 'tools\modavd.exe'), (Join-Path $Root 'tools\modavd.exe'))
-            , @((Join-Path $script:ManagerDir 'ModAVD.exe'), (Join-Path $Root 'ModAVD.exe'))
-        }
+        , @((Join-Path $manager 'tools\modavd.exe'), (Join-Path $Root 'tools\modavd.exe'))
+        , @((Join-Path $manager 'ModAVD.exe'), (Join-Path $Root 'ModAVD.exe'))
         , @((Join-Path (Get-PackageScripts) 'modavd-bridge.ps1'), (Join-Path $Root 'tools\modavd-bridge.ps1')))
     foreach ($p in $pairs) {
         if (-not (Test-Path -LiteralPath $p[0])) { continue }
@@ -26,21 +34,105 @@ function Sync-RootTools([string]$Root) {
     }
 }
 
-# 把测试根 mas-avd.json 的 sdkRoot 换成 $Sdk，返回原值（跑完换回去）。只改这一个值，其余字节不动。顺带同步测试根的工具。
-function Set-RootSdk([string]$Root, [string]$Sdk) {
+# 把测试根 mas-avd.json 的 sdkRoot 换成 $Sdk，返回原值（跑完把原值传回来换回去）。只动这一个键，其余字节不动。顺带同步测试根的工具。
+# testbed 的根是整包装出来的，mas-avd.json 里没有 sdkRoot（用根目录下的 sdk\）：这时在开头的「{」后面加上这个键，返回 $null；
+# 换回去时传 $null，把这个键整行删掉（管理器中途改写过 mas-avd.json、把它挪到最后一个也认）。原来就是 "" 的照样换回 ""。
+function Set-RootSdk([string]$Root, $Sdk) {
     Sync-RootTools $Root
+    Assert-ManagerPortBase $Root (Join-Path $Root 'tools\modavd.exe') | Out-Null
     $p = Join-Path $Root 'mas-avd.json'
     $t = [IO.File]::ReadAllText($p)
-    $m = [regex]::Match($t, '"sdkRoot":\s*"((?:[^"\\]|\\.)*)"')
-    if (-not $m.Success) { throw "$p 里没有 sdkRoot" }
-    $g = $m.Groups[1]
-    $new = $t.Substring(0, $g.Index) + ($Sdk -replace '\\', '\\') + $t.Substring($g.Index + $g.Length)
+    $keyPattern = '"sdkRoot"\s*:\s*"((?:[^"\\]|\\.)*)"'
+    $m = [regex]::Match($t, $keyPattern)
+    $old = if ($m.Success) { $m.Groups[1].Value -replace '\\\\', '\' } else { $null }
+    if ($null -eq $Sdk) {
+        if (-not $m.Success) { return $null }
+        # 后面跟着逗号的（在前面或中间）连同它前面的换行、缩进一起删；是最后一个键的，连同它前面的逗号一起删
+        $cut = [regex]::Match($t, '(\r?\n[ \t]*)?' + $keyPattern + '\s*,[ \t]*')
+        if (-not $cut.Success) { $cut = [regex]::Match($t, ',\s*' + $keyPattern) }
+        if (-not $cut.Success) { $cut = $m }
+        $new = $t.Remove($cut.Index, $cut.Length)
+    } elseif ($m.Success) {
+        $g = $m.Groups[1]
+        $new = $t.Substring(0, $g.Index) + ([string]$Sdk -replace '\\', '\\' -replace '"', '\"') + $t.Substring($g.Index + $g.Length)
+    } else {
+        $brace = $t.IndexOf('{')
+        if ($brace -lt 0) { throw "$p 不是 JSON 对象" }
+        $value = [string]$Sdk -replace '\\', '\\' -replace '"', '\"'
+        $rest = $t.Substring($brace + 1)
+        # 换行和缩进跟着第一个键；空对象就不加逗号
+        $first = [regex]::Match($rest, '^(\r?\n)([ \t]*)"')
+        $entry = if ($first.Success) { "$($first.Groups[1].Value)$($first.Groups[2].Value)`"sdkRoot`": `"$value`"," }
+        elseif ($rest -match '^\s*}') { "`"sdkRoot`": `"$value`"" }
+        else { "`"sdkRoot`": `"$value`", " }
+        $new = $t.Substring(0, $brace + 1) + $entry + $rest
+    }
     [IO.File]::WriteAllText($p, $new, [Text.UTF8Encoding]::new($false))
-    return ($g.Value -replace '\\\\', '\')
+    return $old
 }
 
 function Get-RootConfig([string]$Root) { Get-Content -LiteralPath (Join-Path $Root 'mas-avd.json') -Raw | ConvertFrom-Json }
 
+# 测试根：已有的 ModAVD 根目录（E:\testbed 下的 flow-a / flow-b），回归只在里面建临时实例，不新建根目录（11-05 用户定：
+# testbed 里只有三组模拟器，不可以去别的地方新建）。生产根目录（含 ProductionRoots 列的用户的根）一律拒绝；本机配置列了
+# TestRoots 时只认列出来的。两个 adb server 端口都要写在 mas-avd.json 里、不是生产的（没写时管理器用生产的 20050 / 20049）。
+# 返回完整路径。
+function Resolve-TestRoot([string]$Root, [string]$What = '测试根') {
+    if (-not $Root) { throw "没有$What：给 -Root，或者写进本机配置 TestRoot / PackageRoot（E:\testbed 下已有的根目录）" }
+    $full = [IO.Path]::GetFullPath($Root)
+    Assert-NotProduction $full $What
+    Assert-ListedTestRoot $full $What
+    if (-not (Test-Path -LiteralPath (Join-Path $full 'mas-avd.json') -PathType Leaf)) {
+        throw "$What $full 没有 mas-avd.json：回归只用已有的测试根（E:\testbed 下的 flow-a / flow-b），不新建根目录"
+    }
+    $cfg = Get-RootConfig $full
+    foreach ($k in 'adbServerPort', 'scriptAdbServerPort') {
+        if (-not ($cfg.PSObject.Properties.Name -contains $k -and $cfg.$k)) {
+            throw "$What $full 的 mas-avd.json 没写 $k：没写时管理器用生产的 adb 端口（20050 / 20049），测试根要写自己的"
+        }
+        Assert-NotProductionPort ([int]$cfg.$k) "$What 的 $k"
+    }
+    $full
+}
+
+# 包根清单（modavd-manifest.json）列的文件，相对路径；没有清单、读不出、没有 files 时返回 $null（不知道包里有哪些文件）
+function Get-ManifestFiles([string]$Dir) {
+    $m = Join-Path $Dir 'modavd-manifest.json'
+    if (-not (Test-Path -LiteralPath $m -PathType Leaf)) { return $null }
+    try { $files = (Get-Content -LiteralPath $m -Raw | ConvertFrom-Json -ErrorAction Stop).files } catch { return $null }
+    if ($null -eq $files) { return $null }
+    @($files.PSObject.Properties.Name)
+}
+
+# 换包时要先删的：$Current（根目录现在的清单）有、$Next（要装的包的清单）没有的文件。只会是包里的文件，不会是实例、日志这些。
+function Get-StalePackageFiles($Current, $Next) {
+    @(@($Current) | Where-Object { $_ -and @($Next) -notcontains $_ })
+}
+
+# 把组包目录 $From 装进测试根 $Root（「怎么更新」那样整个覆盖），装哪一版都行（升级测试先装回上一版）：
+# 先删掉根目录现在的包里有、$From 里没有的文件（按两边的 modavd-manifest.json），再整个覆盖。avd、logs、mas-avd.json 这些
+# 不在清单里的不动。$From 的清单认不出（早年的包没有清单）时不知道该删哪些，只覆盖。返回删掉的文件。
+# 清单写错、列了绝对路径、带 ..、或者列了 avd\、logs\、mas-avd.json（实例、日志、配置）时，一个文件都不删就停。
+function Install-Package([string]$From, [string]$Root) {
+    Assert-NotProduction $Root '要换包的根目录'
+    Assert-ListedTestRoot $Root '要换包的根目录'
+    $fromFiles = Get-ManifestFiles $From
+    $stale = if ($null -ne $fromFiles) { Get-StalePackageFiles (Get-ManifestFiles $Root) $fromFiles } else { @() }
+    foreach ($rel in $stale) {
+        if ([IO.Path]::IsPathRooted($rel) -or $rel -match '(^|[\\/])\.\.([\\/]|$)') { throw "清单里的路径不对：$rel" }
+        $top = ($rel -split '[\\/]')[0]
+        if ($top -in 'avd', 'logs', 'mas-avd.json') { throw "清单里列了实例、日志或配置（$rel）：换包不删这些" }
+    }
+    foreach ($rel in $stale) {
+        $p = Join-Path $Root $rel
+        if (Test-Path -LiteralPath $p -PathType Leaf) { Remove-Item -LiteralPath $p -Force }
+    }
+    & robocopy $From $Root /E /COPY:DAT /R:5 /W:2 /NFL /NDL /NP /NJH /NJS | Out-Null
+    if ($LASTEXITCODE -ge 8) { throw "robocopy $From -> $Root 失败（$LASTEXITCODE）" }
+    $global:LASTEXITCODE = 0
+    $stale
+}
+
 # modavd <参数...>，输出逐行返回，退出码在 $LASTEXITCODE
 function M { & (Join-Path $script:Root 'tools\modavd.exe') --root $script:Root @args 2>&1 | ForEach-Object { "$_" } }
 
@@ -78,15 +170,35 @@ function Get-PortBase([string]$Root = $script:Root, [string]$Exe) {
     if ($d.PSObject.Properties.Name -contains 'port_base') { [int]$d.port_base } else { $null }
 }
 
-# 自己搭的根目录（upgrade、ime-pkg）在 mas-avd.json 写了 portBase $Want（0 = 没写）以后，modavd 实际用的端口段：
-# 还不认 portBase 的 modavd 是 20000；认的却不是 $Want 就报错。
-function Resolve-PortBase([string]$Root, [string]$Exe, [int]$Want) {
-    $base = Get-PortBase $Root $Exe
-    if ($null -eq $base) { return 20000 }
-    if ($Want -and $base -ne $Want) { throw "mas-avd.json 写了 portBase $Want，modavd 用的端口段却是 $base" }
-    $base
+# 开测试根的实例之前核对 $Exe（管理器的 modavd.exe）认 portBase，返回它给这个根目录用的端口段。不满足就报错，不开机：
+#  - list --json 没有 port_base：旧版（ModAVDManager 0.3.1 以前）不认 portBase，实例只会开在 20000 段上；
+#  - 根目录的 mas-avd.json 写了 portBase（或 $Want 不是 0）而和 port_base 不一致；
+#  - port_base 是 20000：那是生产根目录的段，测试根不许用。
+# 报错里写管理器路径、版本和看到的 port_base。
+function Assert-ManagerPortBase([string]$Root, [string]$Exe, [int]$Want = 0) {
+    $d = Invoke-ModavdJson $Root $Exe @('list')
+    $seen = if ($d.PSObject.Properties.Name -contains 'port_base') { [int]$d.port_base } else { $null }
+    $cfgPath = Join-Path $Root 'mas-avd.json'
+    $written = 0
+    if (Test-Path -LiteralPath $cfgPath -PathType Leaf) {
+        $c = Get-Content -LiteralPath $cfgPath -Raw | ConvertFrom-Json
+        if ($c.PSObject.Properties.Name -contains 'portBase' -and $c.portBase) { $written = [int]$c.portBase }
+    }
+    $problem = if ($null -eq $seen) { 'list --json 没有 port_base，这版管理器不认 portBase，实例只会开在 20000 段（生产在用）上' }
+        elseif ($seen -eq 20000) { "port_base 是 20000，那是生产根目录的端口段，测试根不许用（mas-avd.json 的 portBase 要写成别的段）" }
+        elseif ($written -and $seen -ne $written) { "mas-avd.json 写了 portBase $written，管理器用的端口段却是 $seen" }
+        elseif ($Want -and $seen -ne $Want) { "要求 portBase $Want，管理器用的端口段却是 $seen" }
+    if ($problem) {
+        $ver = try { (Invoke-ModavdJson $Root $Exe @('version')).version } catch { '查不到' }
+        throw "管理器不能开测试根 $Root 的实例：$problem。管理器 $Exe（版本 $ver），看到的 port_base：$(if ($null -eq $seen) { '无' } else { $seen })"
+    }
+    $seen
 }
 
+# 自己搭的根目录（upgrade、ime-pkg）在 mas-avd.json 写了 portBase $Want（0 = 没写）以后，modavd 实际用的端口段；
+# 核对见 Assert-ManagerPortBase（旧版不认 portBase、port_base 是 20000、和 $Want 不一致都报错）。
+function Resolve-PortBase([string]$Root, [string]$Exe, [int]$Want) { Assert-ManagerPortBase $Root $Exe $Want }
+
 # 新建以后核对第 $i 台的端口落在端口段 $Base 上（控制台 = $Base + 10 × 编号），返回 Get-InstancePorts 的结果
 function Assert-InstancePorts([int]$i, [int]$Base, [string]$Root, [string]$Exe) {
     $p = Get-InstancePorts $i $Root $Exe
diff --git a/items/created-disk-usage.ps1 b/items/created-disk-usage.ps1
index 8b10a09..f428065 100644
--- a/items/created-disk-usage.ps1
+++ b/items/created-disk-usage.ps1
@@ -1,13 +1,14 @@
-# Opt-in measurement on a new, isolated root. Never added to the release suite.
+# Opt-in measurement on a new instance in an existing test root (E:\testbed\flow-a / flow-b): no new roots outside
+# the testbed (11-05). Never added to the release suite. -Work only holds the measurement state, it is not a root.
 param(
     [Parameter(Mandatory)][ValidateSet('Create','Baseline','Resume','Install','Sample','Stop')][string]$Action,
     [Parameter(Mandatory)][string]$Work,
+    # Create: the existing test root the instance goes into (local configuration TestRoot when not given); never the
+    # production root. Later actions take it from the measurement state.
+    [string]$Root,
+    # Create: the package the root must already be on (its modavd-manifest.json version); not installed by this script
     [string]$Package,
-    [string]$OfficialSdk,
-    [int]$PortBase = 27300,
-    [int]$AdbPort = 27383,
-    [int]$ScriptAdbPort = 27384,
-    [int]$Index = 0,
+    [int]$Index = 7,
     [ValidateRange(16,512)][int]$DataGB = 64,
     [string]$Apk,
     [string]$Game,
@@ -19,8 +20,14 @@ $ErrorActionPreference = 'Stop'
 . "$PSScriptRoot\common.ps1"
 . "$PSScriptRoot\disk-usage-lib.ps1"
 $Work = [IO.Path]::GetFullPath($Work)
-$Root = Join-Path $Work 'root'
+Assert-NotProduction $Work 'Work'
 $statePath = Join-Path $Work 'measurement.json'
+if ($Action -eq 'Create') {
+    $Root = Resolve-TestRoot (Use-Local TestRoot $Root '-Root') 'measurement root'
+} else {
+    if (-not (Test-Path -LiteralPath $statePath -PathType Leaf)) { throw 'No measurement state in Work' }
+    $Root = Resolve-TestRoot (Get-Content -Raw -LiteralPath $statePath | ConvertFrom-Json).root 'measurement root'
+}
 $exe = Join-Path $Root 'tools\modavd.exe'
 
 function Run-Modavd([string[]]$ArgsList) {
@@ -46,41 +53,24 @@ function Save-Data([string]$Label) {
 
 if ($Action -eq 'Create') {
     if (Test-Path -LiteralPath $Work) { throw "Work already exists: $Work" }
-    if (-not $Package -or -not $OfficialSdk) { throw 'Create requires -Package and -OfficialSdk' }
-    if ((Test-Inside $Work @($Package, $OfficialSdk)) -or (Test-Inside $Package @($Work)) -or (Test-Inside $OfficialSdk @($Work))) { throw 'Work, package and SDK must be separate directories' }
+    if ((Test-Inside $Work @($Root)) -or (Test-Inside $Root @($Work))) { throw 'Work and the test root must be separate directories' }
     if ($Index -lt 0 -or $Index -gt 9 -or $Index -eq 5) { throw 'Invalid instance index' }
-    if ($PortBase -lt 21000 -or $PortBase -gt 60000 -or $PortBase % 100 -ne 0) { throw 'Choose an isolated portBase, a multiple of 100 in 21000..60000' }
-    if ($AdbPort -eq $ScriptAdbPort -or $AdbPort -notin ($PortBase..($PortBase+99)) -or $ScriptAdbPort -notin ($PortBase..($PortBase+99))) { throw 'Choose two distinct adb ports in the isolated range' }
-    $instancePorts = ($PortBase + 10*$Index)..($PortBase + 10*$Index + 2)
-    if ($AdbPort -in $instancePorts -or $ScriptAdbPort -in $instancePorts) { throw 'adb port overlaps instance ports' }
-    $busy = @(Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | Where-Object LocalPort -in ($PortBase..($PortBase+99)))
-    if ($busy) { throw "Port range in use: $(($busy.LocalPort | Sort-Object -Unique) -join ', ')" }
-    foreach ($file in @('modavd-manifest.json','tools\modavd.exe','sdk\emulator\emulator.exe')) {
-        if (-not (Test-Path -LiteralPath (Join-Path $Package $file) -PathType Leaf)) { throw "Missing package file: $file" }
-    }
-    foreach ($dir in @('platform-tools','system-images')) {
-        if (-not (Test-Path -LiteralPath (Join-Path $OfficialSdk $dir) -PathType Container)) { throw "Missing SDK directory: $dir" }
-        if (Test-Path -LiteralPath (Join-Path $Package "sdk\$dir")) { throw "Package already has sdk\$dir" }
+    $cfg = Get-RootConfig $Root
+    if ((Test-Path -LiteralPath (Join-Path $Root "avd\mas_$Index.avd")) -or ($cfg.instances.PSObject.Properties.Name -contains "$Index")) { throw "Instance $Index already exists in $Root; pick a free -Index" }
+    $version = (Get-Content -Raw -LiteralPath (Join-Path $Root 'modavd-manifest.json') | ConvertFrom-Json).version
+    if ($Package) {
+        $want = (Get-Content -Raw -LiteralPath (Join-Path $Package 'modavd-manifest.json') | ConvertFrom-Json).version
+        if ($want -ne $version) { throw "The test root is on $version, not on the package's ${want}: install the package into it first (upgrade / ime-pkg do it with Install-Package)" }
     }
+    $PortBase = Assert-ManagerPortBase $Root $exe
+    $AdbPort = [int]$cfg.adbServerPort; $ScriptAdbPort = [int]$cfg.scriptAdbServerPort
+    foreach ($p in $AdbPort, $ScriptAdbPort) { Assert-NotProductionPort $p 'test root adb port' }
+    $instancePorts = ($PortBase + 10*$Index)..($PortBase + 10*$Index + 2)
+    $busy = @(Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | Where-Object LocalPort -in $instancePorts)
+    if ($busy) { throw "Instance ports in use: $(($busy.LocalPort | Sort-Object -Unique) -join ', ')" }
     New-Item -ItemType Directory -Path $Work | Out-Null
-    & robocopy $Package $Root /E /COPY:DAT /R:2 /W:1 /NFL /NDL /NP /NJH /NJS | Out-Null
-    if ($LASTEXITCODE -ge 8) { throw "Package copy failed: $LASTEXITCODE" }
-    $manifest = Get-Content -Raw -LiteralPath (Join-Path $Root 'modavd-manifest.json') | ConvertFrom-Json
-    if (-not $manifest.version -or -not $manifest.files) { throw 'Invalid package manifest' }
-    foreach ($entry in $manifest.files.PSObject.Properties) {
-        $file = Join-Path $Root $entry.Name
-        if (-not (Test-Inside $file @($Root)) -or -not (Test-Path -LiteralPath $file -PathType Leaf) -or (Get-FileHash -LiteralPath $file).Hash -ne $entry.Value.sha256) { throw "Package file missing or hash mismatch: $($entry.Name)" }
-    }
-    foreach ($dir in @('platform-tools','system-images')) {
-        & robocopy (Join-Path $OfficialSdk $dir) (Join-Path $Root "sdk\$dir") /E /COPY:DAT /R:2 /W:1 /NFL /NDL /NP /NJH /NJS | Out-Null
-        if ($LASTEXITCODE -ge 8) { throw "SDK copy failed: $LASTEXITCODE" }
-    }
-    @{ adbServerPort=$AdbPort; scriptAdbServerPort=$ScriptAdbPort; portBase=$PortBase } | ConvertTo-Json | Set-Content -LiteralPath (Join-Path $Root 'mas-avd.json') -Encoding utf8
-    $state = [pscustomobject]@{ root=$Root; index=$Index; portBase=$PortBase; adbPort=$AdbPort; scriptAdbPort=$ScriptAdbPort; version=$manifest.version; dataGB=$DataGB; memory='4G'; cpu=4; bridge='default'; serial=''; createStarted=(Get-Date).ToString('o'); samples=@() }
+    $state = [pscustomobject]@{ root=$Root; index=$Index; portBase=$PortBase; adbPort=$AdbPort; scriptAdbPort=$ScriptAdbPort; version=$version; dataGB=$DataGB; memory='4G'; cpu=4; bridge='default'; serial=''; createStarted=(Get-Date).ToString('o'); samples=@() }
     Save-State
-    if ((Get-PortBase $Root $exe) -ne $PortBase) { throw 'Package does not use the requested portBase' }
-    $busy = @(Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | Where-Object LocalPort -in ($PortBase..($PortBase+99)))
-    if ($busy) { throw "Port range became busy while copying: $(($busy.LocalPort | Sort-Object -Unique) -join ', ')" }
     Run-Modavd @('create','--index',"$Index",'--title','disk usage','--memory','4G','--cpu','4','--data-gb',"$DataGB")
     $state | Add-Member -NotePropertyName createFinished -NotePropertyValue (Get-Date).ToString('o')
     $state.serial = (Assert-InstancePorts $Index $PortBase $Root $exe).Serial
@@ -93,9 +83,8 @@ if ($Action -eq 'Create') {
     Run-Modavd @('start',"$Index",'--window')
     Save-Data 'before-install'
     if ($state.samples[-1].inodes.total -ne 1048576) { throw 'This instance does not have the expected inode cap' }
-    Write-Host "Created isolated root. Continue with Install using -Work '$Work'."
+    Write-Host "Created instance $Index in $Root. Continue with Install using -Work '$Work'; afterwards remove it with modavd delete $Index."
 } else {
-    if (-not (Test-Path -LiteralPath $statePath -PathType Leaf)) { throw 'No measurement state in Work' }
     $state = Get-Content -Raw -LiteralPath $statePath | ConvertFrom-Json
     if ($state.root -ne $Root -or -not $state.serial) { throw 'Measurement root or serial does not match' }
     $cfg = Get-RootConfig $Root
diff --git a/items/datadisk.ps1 b/items/datadisk.ps1
index 9764ea2..dc4a638 100644
--- a/items/datadisk.ps1
+++ b/items/datadisk.ps1
@@ -12,7 +12,7 @@ param(
 $ErrorActionPreference = 'Stop'
 [cultureinfo]::CurrentCulture = [cultureinfo]::InvariantCulture
 . "$PSScriptRoot\common.ps1"
-$Root = Use-Local TestRoot $Root '-Root'
+$Root = Resolve-TestRoot (Use-Local TestRoot $Root '-Root')
 
 function DataFacts {
     $o = Su 'df -i /data | tail -n 1; df -k /data | tail -n 1'
diff --git a/items/fetch.ps1 b/items/fetch.ps1
index 13d485d..c4bc2e6 100644
--- a/items/fetch.ps1
+++ b/items/fetch.ps1
@@ -22,6 +22,8 @@ $ErrorActionPreference = 'Stop'
 . "$PSScriptRoot\common.ps1"
 $Cache = Use-Local ComponentCache $Cache '-Cache' -Optional
 if (-not $Work) { $Work = Join-Path (Use-Local TempRoot $null '-Work') 'regress-fetch' }
+$Work = [IO.Path]::GetFullPath($Work)
+Assert-NotProduction $Work '工作目录'
 $Package = (Resolve-Path -LiteralPath $Package).Path
 $fetchBat = Join-Path $Package '补全组件.bat'
 if (-not (Test-Path -LiteralPath (Join-Path $Package 'tools\modavd.exe')) -or -not (Test-Path -LiteralPath $fetchBat)) {
diff --git a/items/game-real.ps1 b/items/game-real.ps1
index 0b5fea3..2943da1 100644
--- a/items/game-real.ps1
+++ b/items/game-real.ps1
@@ -1,7 +1,9 @@
 # 回归项：用各游戏自己的自动化脚本实跑。驱动、实例、启动器、采样脚本都在仓库外，位置在本机配置
 # （local.example.psd1）里：
 #   -Game ark   明日方舟：MAA 集成战略（Kit 的 w1-maa\maa_roguelike.py，先 StartUp 再肉鸽），GameAvdHome 的 mas_6
-#         r1999 重返未来：1999：M9A 启动游戏 + 智能均衡刷材料（Kit 的 m9a_run411_load.py），GameAvdHome 的 mas_7
+#         r1999 重返未来：1999：M9A 启动游戏 + 常规作战打资源本（Kit 的 m9a_run411_load.py），GameAvdHome 的 mas_7；
+#               体力不够时吃不吃糖看 -M9ACandy（默认 0 不吃）。11-05 起不用「智能均衡刷材料」：M9A 4.11.1 里它自己报错、
+#               什么都不打就「成功」退出
 #         sr    崩坏：星穹铁道：SRC 模拟宇宙（SrcKit 的 stress.py，日常挂起；SRC 本身在 SrcDir），SrAvdHome 的 gfx_t2
 #         ef    明日方舟：终末地：MaaEnd（MaaEndDir 的 maaend-run.ps1 -OpenGame），只跑领取类任务，GameAvdHome 的 endfield
 #   -Rounds on（默认）：只跑装桥那一轮，和用户实例一样默认带桥、按包名分流（不再跑不装桥的对照）。
@@ -29,13 +31,16 @@ param(
     # 客体 Vulkan 修复库（本机配置 VulkanFixLib）
     [string]$VulkanFixLib,
     # 不开机、不跑：按 -Out 下各轮存好的驱动输出、采样、日志和 round.json 重新判一次（判法改了以后用）
-    [switch]$ReJudge
+    [switch]$ReJudge,
+    # r1999：常规作战体力不够时最多吃几次糖（传给驱动的 M9A_CANDY）；0 = 不吃，没体力时驱动很快结束，判成没打到战斗
+    [ValidateRange(0, 10)][int]$M9ACandy = 0
 )
 $ErrorActionPreference = 'Stop'
 [cultureinfo]::CurrentCulture = [cultureinfo]::InvariantCulture
 if ($AdbPort -in 5037, 20049, 20050) { throw "adb 端口 $AdbPort 是生产在用的" }
 . (Join-Path $PSScriptRoot '..\local.ps1')
 . (Join-Path $PSScriptRoot 'fps-baseline.ps1')
+. (Join-Path $PSScriptRoot 'port-guard.ps1')
 # 这一项真跑时要的仓库外的东西（-ReJudge 只重新判，都不要）；没配就在这里停
 $need = if ($ReJudge) { @() } else {
     @('Launcher', 'Monitor', 'VulkanFixLib', 'PackageScripts') + @{ ark = @('Kit', 'GameAvdHome'); r1999 = @('Kit', 'GameAvdHome')
@@ -51,9 +56,23 @@ $root1 = Need GameAvdHome
 $cfg = @{
     ark   = @{ Avd = 'mas_6'; Port = 20072; AvdHome = $root1; Memory = 4096; Cores = 4; Pkg = 'com.hypergryph.arknights' }
     r1999 = @{ Avd = 'mas_7'; Port = 20100; AvdHome = $root1; Memory = 6144; Cores = 6; Pkg = 'com.shenlan.m.reverse1999' }
-    sr    = @{ Avd = 'gfx_t2'; Port = 20040; AvdHome = (Need SrAvdHome); Memory = 6144; Cores = 8; Pkg = 'com.miHoYo.hkrpg'; WcAsCached = $true }
+    sr    = @{ Avd = 'gfx_t2'; Port = 20120; AvdHome = (Need SrAvdHome); Memory = 6144; Cores = 8; Pkg = 'com.miHoYo.hkrpg'; WcAsCached = $true }
     ef    = @{ Avd = 'endfield'; Port = 20096; AvdHome = $root1; Memory = 8192; Cores = 6; Pkg = 'com.hypergryph.endfield' }
 }[$Game]
+# 控制台端口可以用本机配置 GamePorts 覆盖（比如 @{ sr = 20120 }）；不管哪来的，都不许落在生产的端口上
+$gamePorts = Use-Local GamePorts $null '' -Optional
+if ($gamePorts -is [System.Collections.IDictionary] -and $gamePorts.Contains($Game)) { $cfg.Port = [int]$gamePorts[$Game] }
+# 实例名可以用本机配置 GameAvds 覆盖（比如 @{ r1999 = 'mas_1' }）：testbed 的根里实例按编号叫 mas_<号>，和以前的测试机不一样
+$gameAvds = Use-Local GameAvds $null '' -Optional
+if ($gameAvds -is [System.Collections.IDictionary] -and $gameAvds.Contains($Game)) {
+    $cfg.Avd = [string]$gameAvds[$Game]
+    if ($cfg.Avd -notmatch '^[A-Za-z0-9_][A-Za-z0-9_.-]*$') { throw "本机配置 GameAvds 里 $Game 的实例名不对：$($cfg.Avd)" }
+}
+if (-not $ReJudge) {
+    Assert-GameConsolePort $cfg.Port "游戏 $Game"
+    # 这一项绕过管理器直接用启动器开机：实例目录在生产根目录下就停（GameAvdHome / SrAvdHome 写错了会开到生产的实例）
+    Assert-NotProduction $cfg.AvdHome "游戏 $Game 的实例目录（GameAvdHome / SrAvdHome）"
+}
 $serial = "emulator-$($cfg.Port)"
 $adbExe = Join-Path $Sdk 'platform-tools\adb.exe'
 $payload = Join-Path $Sdk 'emulator\resources\modavd'
@@ -62,7 +81,8 @@ $packageScripts = Need PackageScripts $env:MODAVD_REGRESS_PACKAGE
 $bridgeScript = if ($packageScripts) { Join-Path $packageScripts 'modavd-bridge.ps1' }
 $monitor = Need Monitor
 $launcher = Need Launcher
-$db = Join-Path $env:LOCALAPPDATA 'Temp\AndroidEmulator'
+# 模拟器的崩溃转储目录；-ReJudge 用不到，没有 LOCALAPPDATA（CI 的 Linux）时也不出错
+$db = [IO.Path]::Combine([string]$env:LOCALAPPDATA, 'Temp', 'AndroidEmulator')
 New-Item -ItemType Directory -Force $Out | Out-Null
 $log = Join-Path $Out 'game-real.log'
 
@@ -100,7 +120,7 @@ function Stop {
 # -Root 指向 $Out\bridge-root（里面的 sdk 是联接到被测 SDK 的）：脚本按它找模拟器版本，工作文件（含客体
 # build.prop 的备份）落在回归输出里，不落进仓库的 tools\logs。输出先改成 UTF-8，免得中文变问号。
 $bridgeRoot = Join-Path $Out 'bridge-root'
-if (-not (Test-Path (Join-Path $bridgeRoot 'sdk'))) {
+if (-not $ReJudge -and -not (Test-Path (Join-Path $bridgeRoot 'sdk'))) {
     New-Item -ItemType Directory -Force $bridgeRoot | Out-Null
     New-Item -ItemType Junction -Path (Join-Path $bridgeRoot 'sdk') -Target $Sdk | Out-Null
 }
@@ -121,7 +141,7 @@ function StartDriver([string]$dir) {
     $env:MAS_AVD_PORT = "$($cfg.Port)"; $env:PYTHONIOENCODING = 'utf-8'
     switch ($Game) {
         'ark' { $env:MAA_LOOP_MIN = "$Minutes"; $env:MAA_LOG = Join-Path $dir 'maa.jsonl'; $exe = 'py'; $al = @('-3.12', '-u', 'maa_roguelike.py', '--adb-port', "$AdbPort"); $wd = "$kit\w1-maa" }
-        'r1999' { $env:M9A_BUDGET_MIN = "$Minutes"; $exe = "$kit\m9a4111\python\python.exe"; $al = @('-u', 'm9a_run411_load.py', '--adb-port', "$AdbPort"); $wd = $kit }
+        'r1999' { $env:M9A_BUDGET_MIN = "$Minutes"; $env:M9A_CANDY = "$M9ACandy"; Remove-Item Env:M9A_PLAN -ErrorAction SilentlyContinue; $exe = "$kit\m9a4111\python\python.exe"; $al = @('-u', 'm9a_run411_load.py', '--adb-port', "$AdbPort"); $wd = $kit }
         'sr' {
             # 和内存测试的星铁负载一样：模拟宇宙，日常全部挂起 23 小时（生产做日常）
             $env:STRESS_MIN = "$Minutes"; $env:STRESS_TRIAL_ROUNDS = '0'; $env:STRESS_ROGUE = '1'
@@ -159,11 +179,30 @@ function DriverVerdict([string]$dir, [int]$exitCode) {
         }
         'r1999' {
             if ($t -notmatch 'done  启动游戏: succeeded') { return $false, 'M9A 启动游戏没成功' }
-            $farm = [regex]::Match($t, 'done  智能均衡刷材料: (\w+) in ([\d.]+) min')
+            $fight = [regex]::Match($t, 'done  常规作战: (\w+) in ([\d.]+) min')
             $budgetStop = $t -match '\(budget stop\)'
-            if (-not $farm.Success) { return $false, 'M9A 刷材料没跑' }
-            if ($farm.Groups[1].Value -ne 'succeeded' -and -not $budgetStop) { return $false, "M9A 刷材料 $($farm.Groups[1].Value)" }
-            return $true, "M9A 刷材料 $($farm.Groups[1].Value)$(if ($budgetStop) { '（到时间停）' })，$($farm.Groups[2].Value) 分钟"
+            if (-not $fight.Success) { return $false, 'M9A 常规作战没跑' }
+            if ($fight.Groups[1].Value -ne 'succeeded' -and -not $budgetStop) { return $false, "M9A 常规作战 $($fight.Groups[1].Value)" }
+            # 没体力（又不吃糖）时常规作战一进去就「成功」退出，没有战斗可测。驱动 11-06 起打出「combat rounds: N」（M9A 自己日志里
+            # 打了几次）：按次数判，0 次就是没打到战斗（体力只够一次时复现 1 次、1.1 分钟就结束，按时长会误判）。
+            # 旧驱动没有这一行、或驱动找不到 M9A 的日志（unknown）时才按时长判：不到 2 分钟算没打（11-05 回归：没体力 0.4–0.6 分钟，
+            # 吃两次糖打完 3.4 分钟）；到时间停的不按时长判。
+            $rounds = [regex]::Match($t, 'combat rounds: (\d+)')
+            $stamina = [regex]::Match($t, 'stamina: (\d+) -> (\d+) \(stage (\d+)\)')
+            $staminaNote = if ($stamina.Success) { "，体力 $($stamina.Groups[1].Value) → $($stamina.Groups[2].Value)（一次 $($stamina.Groups[3].Value)）" } else { '' }
+            $stopNote = if ($budgetStop) { '（到时间停）' } else { '' }
+            if ($rounds.Success) {
+                $n = [int]$rounds.Groups[1].Value
+                if ($n -eq 0) {
+                    $why = if ($budgetStop) { '到时间停了也没打完一次' } else { '体力不够？要吃糖就带 -M9ACandy <次数>' }
+                    return $false, "M9A 常规作战一次都没打（$why）$staminaNote"
+                }
+                return $true, "M9A 常规作战 $($fight.Groups[1].Value)$stopNote，打了 $n 次，$($fight.Groups[2].Value) 分钟$staminaNote"
+            }
+            if (-not $budgetStop -and [double]$fight.Groups[2].Value -lt 2) {
+                return $false, "M9A 常规作战 $($fight.Groups[2].Value) 分钟就结束，没打到战斗（体力不够？要吃糖就带 -M9ACandy <次数>）"
+            }
+            return $true, "M9A 常规作战 $($fight.Groups[1].Value)$stopNote，$($fight.Groups[2].Value) 分钟"
         }
         'sr' {
             if ($t -match 'Traceback') { return $false, 'SRC 驱动有 Traceback' }
diff --git a/items/ime-pkg.ps1 b/items/ime-pkg.ps1
index 42caa63..4a7e525 100644
--- a/items/ime-pkg.ps1
+++ b/items/ime-pkg.ps1
@@ -1,6 +1,7 @@
 # 回归项：用组包目录新建实例，核对随包的宿主输入法（正式签名）开机自动装好、设为默认，跑通道 20 项，再核对开发签名换成正式签名。
-# 根目录照 upgrade.ps1 搭：组包目录整个复制一份（原件不动），adb、系统镜像链到 sdk-official，代替「补全组件」的下载；
-# mas-avd.json 只写私有端口和端口段（portBase）。开关机一律用包里的 tools\modavd.exe（关机先正常关机、不成再 sync 后结束）。
+# 在已有的测试根（本机配置 PackageRoot，没有就 TestRoot；E:\testbed 下的 flow-a / flow-b）上做，不新建根目录（11-05 用户定）：
+# 先把组包目录装进这个根目录（按两边的包根清单换包，avd、logs、mas-avd.json 不动；组包目录原件不动），在里面建一台临时实例。
+# 开关机一律用包里的 tools\modavd.exe（关机先正常关机、不成再 sync 后结束）。
 #  a. modavd create 后第一次 modavd start（无头，和 AUTO-MAS 一样；首次初始化后自己装执行桥，中间关机再开机一两次）：
 #     org.modavd.ime 装上了，base.apk 和包里 components\modavd-ime.apk 逐字节相同（也就是正式签名），已启用，
 #     默认输入法是它，标记 /data/local/tmp/modavd-ime.autoselected 在；
@@ -9,25 +10,19 @@
 #  c. 换签名：卸掉 org.modavd.ime，装开发签名的同一个输入法（证书和正式的不同），启用、设为默认，标记留着；关机再开机：
 #     应该换回正式签名的（base.apk 逐字节相同），默认是它，标记在。再关机开机一次：什么都不变（稳态）；
 #     c 没换成正式签名时，稳态记成「在开发签名的那份上测的」，不算正式签名的稳态；
-#  d. modavd stop，删掉实例和根目录（-Keep 留着）。关机、删实例、等根目录下的进程退出、删根目录，哪步不成都记进问题；
-#     等不到进程退出就不删根目录。日志在 <Work>\logs-<时间>\，不删。
+#  d. modavd stop，删掉这台临时实例（-Keep 留着）；测试根留着、停在这个包上。关机、删实例哪步不成都记进问题。
+#     日志在 <Work>\logs-<时间>\，不删。开始前测试根下要没有在跑的模拟器，编号 -Index 要空着。
 # 用法：pwsh -NoProfile -File items\ime-pkg.ps1 -Package <发版输出>\mas36\release\ModAVD-0.36.0-win-x64
 # 没给的路径取本机配置（local.example.psd1）。
 param(
     # 组包目录（release\ModAVD-<版本>-win-x64），只读
     [Parameter(Mandatory)][string]$Package,
-    # 默认 <TempRoot>\regress-ime-pkg
+    # 在哪个已有的测试根上测（本机配置 PackageRoot，没有就 TestRoot）。不能是生产根目录
+    [string]$Root,
+    # 日志目录的上一级（不是根目录）；默认 <TempRoot>\regress-ime-pkg
     [string]$Work,
-    # 官方 SDK，根目录的 platform-tools、system-images 链到它（OfficialSdk）
-    [string]$Official,
-    [int]$Index = 9,
-    # 根目录私有 adb server 的端口
-    [int]$AdbPort = 20093,
-    # 脚本用的 adb server。不能落在本实例的控制台 / adb / gRPC 端口上，设了 portBase 时也不能落在 20000 段的实例端口上
-    # （modavd 不让）：取 AdbPort - 1 会撞 20000 段 9 号的 gRPC（20092）
-    [int]$ScriptAdbPort = $AdbPort + 1,
-    # 这个根目录的端口段（mas-avd.json 的 portBase），实例就不和同机生产根目录的同编号实例抢端口；0 = 不写，用 20000 段
-    [int]$PortBase = 23000,
+    # 临时实例的编号，测试根里要空着
+    [ValidateRange(0, 9)][int]$Index = 9,
     # 测试 APK（org.modavd.ime.testapp，ModAVDHostIME 编的，不随包发）和开发签名的同一个输入法
     # （ImeTestApk、DevImeApk）
     [string]$TestApk,
@@ -40,19 +35,25 @@ $ErrorActionPreference = 'Stop'
 [cultureinfo]::CurrentCulture = [cultureinfo]::InvariantCulture
 . "$PSScriptRoot\common.ps1"
 if (-not $Work) { $Work = Join-Path (Use-Local TempRoot $null '-Work') 'regress-ime-pkg' }
-$Official = Use-Local OfficialSdk $Official '-Official'
+$Work = [IO.Path]::GetFullPath($Work)
+Assert-NotProduction $Work '工作目录'
+$rootArg = Use-Local PackageRoot $Root '' -Optional
+if (-not $rootArg) { $rootArg = Use-Local TestRoot $null '' -Optional }
+$Root = Resolve-TestRoot $rootArg '输入法回归用的测试根'
+$rootCfg = Get-RootConfig $Root
+$AdbPort = [int]$rootCfg.adbServerPort; $ScriptAdbPort = [int]$rootCfg.scriptAdbServerPort
 $TestApk = Use-Local ImeTestApk $TestApk '-TestApk'
 $DevImeApk = Use-Local DevImeApk $DevImeApk '-DevImeApk'
 $BuildTools = Use-Local BuildTools $BuildTools '-BuildTools'
 # 正式签名密钥的证书（ModAVD 的发布密钥；密钥一旦发出去就不能换）
 $ReleaseCert = 'd18cca3c1982149349f164d28e02490b2eb694e44d56834fa02a1062eb42e823'
 $ImeId = 'org.modavd.ime/.HostImeService'
-$root = Join-Path $Work 'root'
+
 $serial = ''   # 新建以后从 modavd 取
 $runDir = Join-Path $Work "logs-$(Get-Date -Format 'yyyyMMdd-HHmmss')"
-$cliExe = Join-Path $root 'tools\modavd.exe'
-$adbExe = Join-Path $root 'sdk\platform-tools\adb.exe'
-function Modavd { & $cliExe --root $root @args 2>&1 | ForEach-Object { "$_" } }
+$cliExe = Join-Path $Root 'tools\modavd.exe'
+$adbExe = Join-Path $Root 'sdk\platform-tools\adb.exe'
+function Modavd { & $cliExe --root $Root @args 2>&1 | ForEach-Object { "$_" } }
 function Adb { & $adbExe -P $AdbPort -s $serial @args 2>&1 | ForEach-Object { "$_" } }
 function Log([string]$m) {
     $l = "$(Get-Date -Format 'HH:mm:ss') $m"
@@ -129,9 +130,9 @@ function Halt([string]$Tag) {
 # 模拟器带窗口要等的进程、文件锁：根目录下还有进程（私有 adb server 除外）就等，最多 $Seconds 秒
 function WaitRootIdle([int]$Seconds = 90) {
     $t0 = Get-Date
-    $tools = Join-Path $root 'sdk\platform-tools'
+    $tools = Join-Path $Root 'sdk\platform-tools'
     while ($true) {
-        $busy = @(Get-CimInstance Win32_Process | Where-Object { $_.ExecutablePath -and $_.ExecutablePath.StartsWith($root, [StringComparison]::OrdinalIgnoreCase) -and
+        $busy = @(Get-CimInstance Win32_Process | Where-Object { $_.ExecutablePath -and $_.ExecutablePath.StartsWith($Root, [StringComparison]::OrdinalIgnoreCase) -and
                 -not $_.ExecutablePath.StartsWith($tools, [StringComparison]::OrdinalIgnoreCase) })
         if (-not $busy) { return $true }
         if (((Get-Date) - $t0).TotalSeconds -ge $Seconds) { Log "等了 $Seconds 秒，根目录下还有进程：$(($busy | ForEach-Object { "$($_.Name)($($_.ProcessId))" }) -join '、')"; return $false }
@@ -142,14 +143,17 @@ function WaitRootIdle([int]$Seconds = 90) {
 $problems = @(); $notes = @(); $made = $false; $created = $false; $swapped = $false
 try {
     # ---- 前提：组包目录、两个 APK 的签名、端口
-    if (Test-Path -LiteralPath $root) { throw "$root 已存在（上次留下的？删掉或换 -Work）" }
+    # 测试根下不能有在跑的模拟器（别的会话可能正开着它的实例），临时实例的编号要空着
+    if (-not (WaitRootIdle 5)) { throw "测试根 $Root 下还有模拟器在跑" }
+    if ((Test-Path -LiteralPath (Join-Path $Root "avd\mas_$Index.avd")) -or ($rootCfg.instances.PSObject.Properties.Name -contains "$Index")) {
+        throw "测试根 $Root 里已经有 $Index 号实例，换一个空着的 -Index"
+    }
     if (-not (Test-Path -LiteralPath (Join-Path $Package 'sdk\emulator\emulator.exe'))) { throw "不是组包目录：$Package" }
     $pkgApk = Join-Path $Package 'components\modavd-ime.apk'
     foreach ($f in $pkgApk, (Join-Path $Package 'tools\modavd.exe'), $TestApk, $DevImeApk, (Join-Path $BuildTools 'apksigner.bat')) {
         if (-not (Test-Path -LiteralPath $f)) { throw "找不到 $f" }
     }
-    foreach ($p in $AdbPort, $ScriptAdbPort) { if ($p -in 5037, 20049, 20050) { throw "adb server 端口 $p 是生产用的，不碰" } }
-    if ($AdbPort -eq $ScriptAdbPort) { throw '私有和脚本用的 adb server 端口不能一样' }
+    foreach ($p in $AdbPort, $ScriptAdbPort) { Assert-NotProductionPort $p '测试根的 adb server 端口' }
     New-Item -ItemType Directory -Force $runDir | Out-Null
     $buildId = (Select-String -LiteralPath (Join-Path $Package 'sdk\emulator\source.properties') -Pattern '^Pkg\.BuildId=(.+)$').Matches[0].Groups[1].Value.Trim()
     $pkgSha = (Get-FileHash -LiteralPath $pkgApk).Hash.ToLower(); $pkgCert = CertOf $pkgApk
@@ -159,30 +163,30 @@ try {
     if ($pkgCert -ne $ReleaseCert) { throw "包里的 modavd-ime.apk 不是正式签名（证书 $pkgCert）" }
     if ($devCert -eq '?' -or $devCert -eq $ReleaseCert -or $devSha -eq $pkgSha) { throw "$DevImeApk 不是另一把密钥签的（证书 $devCert）" }
 
-    # ---- 根目录：组包目录的副本
+    # ---- 测试根装上这个组包目录
     $made = $true
-    & robocopy $Package $root /E /COPY:DAT /R:5 /W:2 /NFL /NDL /NP /NJH /NJS | Out-Null
-    if ($LASTEXITCODE -ge 8) { throw "robocopy $Package -> $root 失败（$LASTEXITCODE）" }
-    foreach ($n in 'platform-tools', 'system-images') { New-Item -ItemType Junction -Path (Join-Path $root "sdk\$n") -Target (Join-Path $Official $n) | Out-Null }
-    $pb = if ($PortBase) { ",`n  `"portBase`": $PortBase" } else { '' }
-    [IO.File]::WriteAllText((Join-Path $root 'mas-avd.json'), "{`n  `"adbServerPort`": $AdbPort,`n  `"scriptAdbServerPort`": $ScriptAdbPort$pb`n}`n", [Text.UTF8Encoding]::new($false))
+    $beforeVersion = (Get-Content -LiteralPath (Join-Path $Root 'modavd-manifest.json') -Raw -ErrorAction SilentlyContinue | ConvertFrom-Json).version
+    $removed = @(Install-Package $Package $Root)
+    Log "测试根 $Root 装上 $Package（测之前是 $(if ($beforeVersion) { $beforeVersion } else { '没有清单' })；换包删掉 $($removed.Count) 个这个包没有的文件）"
     # 实例的端口按包里的 modavd 用的端口段算：新建时就要无头开一次机，开之前先看端口
-    $base = Resolve-PortBase $root $cliExe $PortBase
-    if ($PortBase -and $base -ne $PortBase) { $notes += '包里的 modavd 还不认 portBase，实例在 20000 段上' }
+    $base = Resolve-PortBase $Root $cliExe 0
     $consolePort = $base + 10 * $Index
     $mine = $consolePort..($consolePort + 2)
     foreach ($p in $AdbPort, $ScriptAdbPort) {
         if ($p -in $mine) { throw "adb server 端口 $p 和 $Index 号实例的控制台 / adb / gRPC 端口（$($mine -join '、')）撞了" }
     }
-    $busyPorts = @(Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | Where-Object { $_.LocalPort -in (@($AdbPort, $ScriptAdbPort) + $mine) } | ForEach-Object { $_.LocalPort } | Sort-Object -Unique)
-    if ($busyPorts) { throw "端口已被占用：$($busyPorts -join '、')" }
-    Log "根目录 $root（adb server $AdbPort / $ScriptAdbPort，端口段 $base）"
+    # 测试根自己的 adb server 开着不算（前一项留下的，比如发版回归里先跑的 upgrade）；实例的端口、别的程序占着 adb 端口才停
+    $listeners = @(Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | Where-Object { $_.LocalPort -in (@($AdbPort, $ScriptAdbPort) + $mine) } |
+        ForEach-Object { [pscustomobject]@{ LocalPort = [int]$_.LocalPort; Path = (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Path } })
+    $busyPorts = @(Get-PortConflicts $listeners $mine @($AdbPort, $ScriptAdbPort) $adbExe)
+    if ($busyPorts) { throw "端口已被占用：$($busyPorts -join '、')（adb server 的端口只许测试根自己的 adb 占着）" }
+    Log "根目录 $Root（adb server $AdbPort / $ScriptAdbPort，端口段 $base）"
 
     # ---- a. 新建、第一次开机
     $o = Modavd create --index $Index --title 输入法回归 --memory 4G --cpu 4 --data-gb 16
     if ($LASTEXITCODE -ne 0) { throw "新建失败：$($o -join ' ')" }
     $created = $true
-    $serial = (Assert-InstancePorts $Index $base $root $cliExe).Serial
+    $serial = (Assert-InstancePorts $Index $base $Root $cliExe).Serial
     $b = Boot 'a-first'
     $b.Ime | ForEach-Object { Log "  a: $_" }
     if ($b.Code -ne 0) { throw "第一次开机失败（退出码 $($b.Code)）：$($b.Tail)" }
@@ -201,11 +205,11 @@ try {
     $sb = Snapshot 'b'
     $diff = Changed $sa $sb
     if ($diff -or -not ($b.Ime -match '已是最新')) { $problems += "b 再开机输入法变了：$($diff -join '；')（$($b.Ime -join ' / ')）" }
-    $emuLog = Get-ChildItem -LiteralPath (Join-Path $root 'logs') -File | Where-Object { $_.Name -match "^mas_$Index-\d{8}-\d{6}\.log$" } |
+    $emuLog = Get-ChildItem -LiteralPath (Join-Path $Root 'logs') -File | Where-Object { $_.Name -match "^mas_$Index-\d{8}-\d{6}\.log$" } |
         Sort-Object LastWriteTime -Descending | Select-Object -First 1 -ExpandProperty FullName
     if (-not $emuLog) { throw '找不到这次开机的模拟器日志' }
     $regOut = Join-Path $runDir 'ime-reg'
-    & pwsh -NoProfile -File (Join-Path $PSScriptRoot 'ime-reg.ps1') -Attach -Sdk (Join-Path $root 'sdk') -Out $regOut -AdbExe $adbExe `
+    & pwsh -NoProfile -File (Join-Path $PSScriptRoot 'ime-reg.ps1') -Attach -Sdk (Join-Path $Root 'sdk') -Out $regOut -AdbExe $adbExe `
         -AdbPort $AdbPort -Serial $serial -EmulatorLog $emuLog -TestApk $TestApk 2>&1 | ForEach-Object { Write-Host "  ime-reg: $_" }
     $regLog = @(Get-Content -LiteralPath (Join-Path $regOut 'ime-reg.log') -Encoding utf8 -ErrorAction SilentlyContinue)
     $sum = $regLog | Select-String -Pattern '汇总：PASS (\d+)，FAIL (\d+)' | Select-Object -Last 1
@@ -266,25 +270,10 @@ sync
             if ($code -ne 0) { $problems += "收尾删实例试了 30 次都没成（退出码 $code）：$(($o | Select-Object -Last 1))"; Log $problems[-1] }
         }
     }
-    # 这个根目录的私有 adb server 跑完就关：留着会一直占着端口
+    # 测试根是共用的：它的 adb server 和根目录都留着，停在这个包上
     if ($made) {
-        foreach ($p in $AdbPort, $ScriptAdbPort) { & (Join-Path $Official 'platform-tools\adb.exe') -P $p kill-server 2>&1 | Out-Null }
-    }
-    if ($made -and -not $Keep) {
-        # 根目录下还有进程在跑就不删：删一半的根目录比留着更难收拾
-        if (-not (WaitRootIdle)) { $problems += "收尾等了 90 秒根目录下还有进程，没删 $root"; Log $problems[-1] }
-        else {
-            # 先拆两个目录联接（rmdir 只删联接本身），确认根目录下没有任何重解析点了，才整个删掉：绝不能删进 sdk-official
-            foreach ($n in 'platform-tools', 'system-images') { $j = Join-Path $root "sdk\$n"; if (Test-Path -LiteralPath $j) { cmd /c rmdir "$j" | Out-Null } }
-            $links = @(Get-ChildItem -LiteralPath $root -Recurse -Force -Attributes ReparsePoint -ErrorAction SilentlyContinue)
-            if ($links) { $problems += "收尾时根目录下还有联接，没删 $root：$($links.FullName -join '、')"; Log $problems[-1] }
-            else {
-                for ($k = 0; $k -lt 15 -and (Test-Path -LiteralPath $root); $k++) {
-                    try { Remove-Item -LiteralPath $root -Recurse -Force -ErrorAction Stop } catch { Start-Sleep 2 }
-                }
-                if (Test-Path -LiteralPath $root) { $problems += "收尾删了 15 次 $root 还没删干净"; Log $problems[-1] } else { Log "删掉了 $root（日志留在 $runDir）" }
-            }
-        }
+        $nowVersion = (Get-Content -LiteralPath (Join-Path $Root 'modavd-manifest.json') -Raw -ErrorAction SilentlyContinue | ConvertFrom-Json).version
+        $notes += "测试根 $Root 现在是 $nowVersion（测之前 $(if ($beforeVersion) { $beforeVersion } else { '没有清单' })）；日志在 $runDir"
     }
 }
 $summary = $notes -join '；'
diff --git a/items/ime-reg.ps1 b/items/ime-reg.ps1
index 0a48c1a..0dd4313 100644
--- a/items/ime-reg.ps1
+++ b/items/ime-reg.ps1
@@ -28,6 +28,10 @@ if ($Attach -and -not ($PSBoundParameters.ContainsKey('AdbPort') -and $PSBoundPa
 if ($AdbPort -in 5037, 20049, 20050) { throw "adb 端口 $AdbPort 是生产用的，不碰" }
 . (Join-Path $PSScriptRoot '..\local.ps1')
 if (-not $Out) { $Out = Join-Path (Use-Local TempRoot $null '-Out') 'regress-ime' }
+Assert-NotProduction $Out '输出目录'
+# 不经管理器、直接用启动器开机：实例目录在生产根目录（或 ProductionRoots 列的用户的根）下就停，在建任何目录之前
+$imeAvdHome = if ($Attach) { $null } else { Use-Local ImeAvdHome $null 'ImeAvdHome' }
+if ($imeAvdHome) { Assert-NotProduction $imeAvdHome '输入法冒烟机的实例目录（ImeAvdHome）' }
 if (-not $AdbExe) { $AdbExe = Join-Path $Sdk 'platform-tools\adb.exe' }
 New-Item -ItemType Directory -Force $Out, "$Out\emu" | Out-Null
 $log = "$Out\ime-reg.log"
@@ -79,7 +83,7 @@ if ($Attach) {
 else {
     if (Get-Qemu) { L 'imesmoke 已经开着，不动它，退出'; exit 2 }
     L "开始；SDK $Sdk（$((Select-String -Path "$Sdk\emulator\source.properties" -Pattern 'BuildId').Line)）"
-    $env:ANDROID_AVD_HOME = Use-Local ImeAvdHome $null 'ImeAvdHome'
+    $env:ANDROID_AVD_HOME = $imeAvdHome
     $launcher = Use-Local Launcher $null 'Launcher'
     cmd /c "pwsh -NoProfile -File `"$launcher`" -Avd imesmoke -ConsolePort 20110 -AdbPort 20089 -Sdk `"$Sdk`" -LogDir `"$Out\emu`" -NoLogcat > `"$Out\launcher.log`" 2>&1"
     Get-Content "$Out\launcher.log" | Select-String 'SDK:|booted|adb server' | ForEach-Object { L "launcher: $($_.Line.Trim())" }
diff --git a/items/port-guard.ps1 b/items/port-guard.ps1
new file mode 100644
index 0000000..b8757ba
--- /dev/null
+++ b/items/port-guard.ps1
@@ -0,0 +1,22 @@
+# 端口守卫（纯函数，不依赖别的脚本；common.ps1 和 game-real.ps1 都引它）。
+
+# 游戏实例的控制台端口（含 +1 的 adb、+2 的 gRPC）不能落在生产根目录的 20000–20049 段上，也不能碰 5037 和生产的 adb server
+# 20049 / 20050。测试和生产共用一台电脑，开到生产的端口上会顶掉生产的实例。
+function Assert-GameConsolePort([int]$Port, [string]$Name = '游戏实例') {
+    foreach ($p in $Port, ($Port + 1), ($Port + 2)) {
+        if ($p -ge 20000 -and $p -le 20049) { throw "$Name 的控制台端口 $Port（含 +1、+2 的 adb / gRPC 端口）落在生产的 20000–20049 段上，换一个：本机配置 GamePorts" }
+        if ($p -in 5037, 20049, 20050) { throw "$Name 的控制台端口 $Port（含 +1、+2 的 adb / gRPC 端口）碰到生产在用的 $p，换一个：本机配置 GamePorts" }
+    }
+}
+
+# 在已有的测试根里新建实例前，哪些端口被占着不能开（返回端口号，排好序、不重复）。
+# $Listeners 是正在监听的端口，每个带 LocalPort 和占着它的程序路径 Path（取不到是空）。
+# 实例自己的控制台 / adb / gRPC 端口要空着；测试根的两个 adb server 端口可以是这个测试根自己的 adb.exe 占着
+# （前一项、前一次开机留下的，modavd 接着用），别的程序占着才算。
+function Get-PortConflicts($Listeners, [int[]]$InstancePorts, [int[]]$AdbPorts, [string]$RootAdb) {
+    $own = [IO.Path]::GetFullPath($RootAdb)
+    @($Listeners | Where-Object {
+            $_.LocalPort -in $InstancePorts -or
+            ($_.LocalPort -in $AdbPorts -and -not ($_.Path -and [string]::Equals([IO.Path]::GetFullPath($_.Path), $own, [StringComparison]::OrdinalIgnoreCase)))
+        } | ForEach-Object { [int]$_.LocalPort } | Sort-Object -Unique)
+}
diff --git a/items/upgrade.ps1 b/items/upgrade.ps1
index 80303c7..aa0962d 100644
--- a/items/upgrade.ps1
+++ b/items/upgrade.ps1
@@ -1,8 +1,9 @@
 # 回归项：从上一个发布版升级。
-# 用上一版正式包的组包目录搭一个根目录：adb、系统镜像链到 sdk-official，代替「补全组件」的下载；mas-avd.json 只写私有端口
-# 和端口段（portBase），和 AUTO-MAS 加根目录时一样。用旧模拟器新建一台实例、开机、写标记数据、关机。旧包里没有 modavd，
-# 开关机用新编的，它是 AUTO-MAS 开关机流程的移植。再照「怎么更新」把新包整个覆盖上去（avd 不动），然后核对：
-#  - 组包目录按包根清单的版本号是否上升判，缺清单时按构建号判；SDK 构建号相同只记说明。包根文件都在
+# 在已有的测试根（本机配置 PackageRoot，没有就 TestRoot；E:\testbed 下的 flow-a / flow-b）上做，不新建根目录（11-05 用户定）：
+# 先把这个根目录装回上一版（按两边的包根清单换包，avd、logs、mas-avd.json 不动），用旧模拟器新建一台临时实例、开机、
+# 写标记数据、关机。开关机用新编的 modavd（AUTO-MAS 开关机流程的移植；早年的旧包里没有 modavd）。再照「怎么更新」把新包
+# 整个覆盖上去（avd 不动），然后核对：
+#  - 组包目录按包根清单的版本号是否上升判，缺清单时按构建号判；SDK 构建号相同只记说明。包根的 ModAVD.exe / tools\modavd.exe / tools\modavd-bridge.ps1 都在
 #  - 用包里的 tools\modavd.exe 开机，标记数据都在
 #  - set --data-gb 改大后开机扩满（旧模拟器建的 64 GB 盘）
 #  - 升级后第一次用 modavd（管理器同一套）照常开机，旧实例自己装上执行桥（10-30 起用户不用自己装）。
@@ -13,43 +14,39 @@
 #    还记下升级前客体有没有它：上一版早于 0.36.0 时旧根目录没有这个 APK，升级前那次开机 modavd 不装，升级后有了才说明是
 #    跟着新包来的；上一版是 0.36.0 及以后时，升级前那次开机已经装上旧包那份，这条记录只作参考。
 #    -Next 是 SDK 目录时没有 components，不查。
-# 跑完删掉这台实例和这个根目录（-Keep 留着）。收尾的关机、删实例、等根目录下的进程退出、删目录，哪步不成都记进问题；
-# 等不到进程退出就不删。
+# 跑完删掉这台临时实例（-Keep 留着），测试根留着、停在新包上（结论里写它测之前、测之后各是哪一版）。收尾的关机、删实例，
+# 哪步不成都记进问题。开始前测试根下要没有在跑的模拟器，编号 -Index 要空着。
 param(
     # 新包的组包目录（release\ModAVD-<版本>-win-x64）；或者 SDK 根目录（有 emulator\），这时包根文件取 -ModavdOut
     # 和随包脚本目录（common.ps1）
     [Parameter(Mandatory)][string]$Next,
     # 上一版的组包目录：只测生产现在跑的那一版（本机配置 PrevPackage）
     [string]$Prev,
-    # 放着 tools\modavd.exe 和 ModAVD.exe 的目录；默认取 common.ps1 的管理器目录
+    # 放着 tools\modavd.exe 和 ModAVD.exe 的目录；默认取 common.ps1 的管理器目录（环境变量 MODAVD_REGRESS_MANAGER）
     [string]$ModavdOut,
-    # 默认 <TempRoot>\regress-upgrade
+    # 在哪个已有的测试根上测（本机配置 PackageRoot，没有就 TestRoot）。不能是生产根目录
+    [string]$Root,
+    # 临时文件（新 modavd 的副本、单用的 netsim 发现目录、推进客体的脚本），跑完删；默认 <TempRoot>\regress-upgrade。不是根目录
     [string]$Work,
-    # 官方 SDK：根目录的 platform-tools、system-images 链到它，代替「补全组件」的下载（OfficialSdk）
-    [string]$Official,
-    [int]$Index = 4,
-    # 这个根目录私有 adb server 的端口。不能和别的测试机的模拟器端口撞：
-    # 10-29 用 20097 时，终末地 coldprof 的实例（20096/20097）起不来
-    [int]$AdbPort = 20083,
-    # 脚本用的 adb server。设了 portBase 的根目录，modavd 不让两个 server 落在 20000 段的实例端口上：
-    # 以前取 AdbPort - 1（20082）正是 8 号的 gRPC 端口
-    [int]$ScriptAdbPort = $AdbPort + 1,
-    # 这个根目录的端口段（mas-avd.json 的 portBase），实例就不和同机生产根目录的同编号实例抢端口；0 = 不写，用 20000 段
-    [int]$PortBase = 23000,
+    # 临时实例的编号，测试根里要空着
+    [ValidateRange(0, 9)][int]$Index = 8,
     [switch]$Keep
 )
 $ErrorActionPreference = 'Stop'
 [cultureinfo]::CurrentCulture = [cultureinfo]::InvariantCulture
 . "$PSScriptRoot\common.ps1"
 $Prev = Use-Local PrevPackage $Prev '-Prev'
-if (-not $ModavdOut) { $ModavdOut = Use-Local Manager $script:ManagerDir '-ModavdOut' }
+if (-not $ModavdOut) { $ModavdOut = Get-ManagerDir }
 if (-not $Work) { $Work = Join-Path (Use-Local TempRoot $null '-Work') 'regress-upgrade' }
-$Official = Use-Local OfficialSdk $Official '-Official'
-$root = Join-Path $Work 'root'
+$Work = [IO.Path]::GetFullPath($Work)
+Assert-NotProduction $Work '工作目录'
+$rootArg = Use-Local PackageRoot $Root '' -Optional
+if (-not $rootArg) { $rootArg = Use-Local TestRoot $null '' -Optional }
+$Root = Resolve-TestRoot $rootArg '升级用的测试根'
 $serial = ''   # 新建以后从 modavd 取
 $script:CliExe = Join-Path $Work 'cli\modavd.exe'
-function Modavd { & $script:CliExe --root $root @args 2>&1 | ForEach-Object { "$_" } }
-function Adb { & (Join-Path $root 'sdk\platform-tools\adb.exe') -P $AdbPort -s $serial @args 2>&1 | ForEach-Object { "$_" } }
+function Modavd { & $script:CliExe --root $Root @args 2>&1 | ForEach-Object { "$_" } }
+function Adb { & (Join-Path $Root 'sdk\platform-tools\adb.exe') -P $AdbPort -s $serial @args 2>&1 | ForEach-Object { "$_" } }
 # 临时脚本写在 $Work 下，不放系统临时目录；$Work 由搭根目录那步建好，跑完整个删掉
 function SuRun([string]$Script) {
     $tmp = Join-Path $Work "regress-up-$PID.sh"
@@ -76,9 +73,9 @@ function Overlay([string]$from, [string]$to) {
 # 根目录自己的 adb server（sdk\platform-tools）一直开着，包里没有 platform-tools、覆盖碰不到它，不等。
 function WaitRootIdle([int]$seconds = 90) {
     $t0 = Get-Date
-    $tools = Join-Path $root 'sdk\platform-tools'
+    $tools = Join-Path $Root 'sdk\platform-tools'
     while ($true) {
-        $busy = @(Get-CimInstance Win32_Process | Where-Object { $_.ExecutablePath -and $_.ExecutablePath.StartsWith($root, [StringComparison]::OrdinalIgnoreCase) -and
+        $busy = @(Get-CimInstance Win32_Process | Where-Object { $_.ExecutablePath -and $_.ExecutablePath.StartsWith($Root, [StringComparison]::OrdinalIgnoreCase) -and
                 -not $_.ExecutablePath.StartsWith($tools, [StringComparison]::OrdinalIgnoreCase) })
         if (-not $busy) { return }
         if (((Get-Date) - $t0).TotalSeconds -ge $seconds) { throw "等了 $seconds 秒，根目录下还有进程在跑：$(($busy | ForEach-Object { "$($_.Name)($($_.ProcessId))" }) -join '、')" }
@@ -88,9 +85,16 @@ function WaitRootIdle([int]$seconds = 90) {
 
 $problems = @(); $notes = @(); $created = $false; $made = $false
 $tag = "upgrade-$(Get-Date -Format 'yyyyMMddHHmmss')"
+$AdbPort = [int](Get-RootConfig $Root).adbServerPort
 try {
     if (Test-Path -LiteralPath $Work) { throw "$Work 已存在（上次留下的？删掉或换 -Work）" }
     if (-not (Test-Path (Join-Path $Prev 'sdk\emulator\emulator.exe'))) { throw "上一版的组包目录不对：$Prev" }
+    Assert-NotProductionPort $AdbPort '测试根的 adbServerPort'
+    # 测试根下不能有在跑的模拟器（别的会话可能正开着它的实例），临时实例的编号要空着
+    WaitRootIdle 5
+    if ((Test-Path -LiteralPath (Join-Path $Root "avd\mas_$Index.avd")) -or ((Get-RootConfig $Root).instances.PSObject.Properties.Name -contains "$Index")) {
+        throw "测试根 $Root 里已经有 $Index 号实例，换一个空着的 -Index"
+    }
     $nextIsTree = Test-Path (Join-Path $Next 'sdk\emulator\emulator.exe')
     if (-not $nextIsTree -and -not (Test-Path (Join-Path $Next 'emulator\emulator.exe'))) { throw "新包既不是组包目录也不是 SDK：$Next" }
     $nextHasManifest = $nextIsTree -and (Test-Path -LiteralPath (Join-Path $Next 'modavd-manifest.json'))
@@ -100,31 +104,29 @@ try {
     $checkIme = $imeApk -and (Test-Path -LiteralPath $imeApk)
     $imeSkip = if (-not $nextIsTree) { '新包是 SDK 目录、没有 components，不查宿主输入法' } elseif (-not $checkIme) { '新包里没有 components\modavd-ime.apk，不查宿主输入法' }
 
-    # ---- 上一版的根目录
+    # ---- 测试根装回上一版
+    New-Item -ItemType Directory -Path $Work | Out-Null
     $made = $true
+    $beforeVersion = PackageVersion $Root
     # 模拟器按发现目录里的 netsim.ini 找 netsimd（模拟器和 netsimd 都先认 TMPDIR，没设时是 %LOCALAPPDATA%\Temp），
     # 同一用户的模拟器不管来自哪个 SDK 都共用一个。10-30 并行跑别的测试时，别处的模拟器连上了这个根目录起的 netsimd，
     # 这边关机后它一直不退，覆盖前和收尾都等不到。这里的模拟器单用一个发现目录：别人连不上它的，它也不去连别人的
     $netsimDir = Join-Path $Work 'netsim'
     New-Item -ItemType Directory -Force $netsimDir | Out-Null
     $env:TMPDIR = $netsimDir
-    Overlay $Prev $root
-    foreach ($n in 'platform-tools', 'system-images') { New-Item -ItemType Junction -Path (Join-Path $root "sdk\$n") -Target (Join-Path $Official $n) | Out-Null }
-    $pb = if ($PortBase) { ",`n  `"portBase`": $PortBase" } else { '' }
-    [IO.File]::WriteAllText((Join-Path $root 'mas-avd.json'), "{`n  `"adbServerPort`": $AdbPort,`n  `"scriptAdbServerPort`": $ScriptAdbPort$pb`n}`n", [Text.UTF8Encoding]::new($false))
+    $removed = @(Install-Package $Prev $Root)
     New-Item -ItemType Directory -Force (Split-Path $script:CliExe) | Out-Null
     Copy-Item -LiteralPath $newCli -Destination $script:CliExe
-    $oldId = BuildId (Join-Path $root 'sdk\emulator')
-    $oldVersion = PackageVersion $root
-    $base = Resolve-PortBase $root $script:CliExe $PortBase
-    if ($PortBase -and $base -ne $PortBase) { $notes += '这版 modavd 还不认 portBase，实例在 20000 段上' }
-    Say "上一版根目录 $root（$oldId，端口段 $base）"
+    $oldId = BuildId (Join-Path $Root 'sdk\emulator')
+    $oldVersion = PackageVersion $Root
+    $base = Resolve-PortBase $Root $script:CliExe 0
+    Say "测试根 $Root 装回上一版：$(if ($oldVersion) { $oldVersion.Text } else { $oldId })（测之前是 $(if ($beforeVersion) { $beforeVersion.Text } else { '没有清单' })；换包删掉 $($removed.Count) 个上一版没有的文件；端口段 $base）"
 
     $o = Modavd create --index $Index --title 升级测试 --memory 4G --cpu 4
     if ($LASTEXITCODE -ne 0) { throw "旧版里新建失败：$($o -join ' ')" }
     $created = $true
-    $serial = (Assert-InstancePorts $Index $base $root $script:CliExe).Serial
-    Remove-Item -LiteralPath (Join-Path $root "avd\mas_$Index.avd\modavd-writable-system") -ErrorAction SilentlyContinue   # 旧版建的没有
+    $serial = (Assert-InstancePorts $Index $base $Root $script:CliExe).Serial
+    Remove-Item -LiteralPath (Join-Path $Root "avd\mas_$Index.avd\modavd-writable-system") -ErrorAction SilentlyContinue   # 旧版建的没有
     Modavd start $Index --no-bridge | Select-Object -Last 1 | ForEach-Object { Say "  $_" }
     if ($LASTEXITCODE -ne 0) { throw "旧版开机失败（退出码 $LASTEXITCODE）" }
     # /sdcard 要等 sys.boot_completed 之后才开始挂（emulated;0，正常约 2 秒，宿主忙时更久），modavd start 和 AUTO-MAS 一样
@@ -149,7 +151,7 @@ echo "sdwait=$i"
     if ($checkIme) {
         # 上一版早于 0.36.0 时旧根目录没有 components\modavd-ime.apk，这时客体应该还没有它：升级后有了，才说明是跟着新包来的。
         # 上一版是 0.36.0 及以后时，这次开机 modavd 已经装上了旧包那份，这条只作参考
-        $prevIme = Test-Path -LiteralPath (Join-Path $root 'components\modavd-ime.apk')
+        $prevIme = Test-Path -LiteralPath (Join-Path $Root 'components\modavd-ime.apk')
         $pre = (SuRun 'pm path org.modavd.ime 2>/dev/null' | ForEach-Object { $_.Trim() } | Where-Object { $_ }) -join ' '
         $preNote = if ($pre) { "升级前客体已有 org.modavd.ime（$pre）" } else { '升级前客体没有 org.modavd.ime' }
         if ($prevIme) { $preNote += '（上一版包里就带 components\modavd-ime.apk，只作参考）' }
@@ -161,18 +163,18 @@ echo "sdwait=$i"
     $t1 = Get-Date
     WaitRootIdle
     Say ("关机后等根目录下的进程退出用了 {0:N0} 秒" -f ((Get-Date) - $t1).TotalSeconds)
-    if ($nextIsTree) { Overlay $Next $root }
+    if ($nextIsTree) { Install-Package $Next $Root | Out-Null }
     else {
-        Overlay (Join-Path $Next 'emulator') (Join-Path $root 'sdk\emulator')
-        Copy-Item -LiteralPath (Join-Path $ModavdOut 'tools\modavd.exe') -Destination (Join-Path $root 'tools\modavd.exe') -Force
-        Copy-Item -LiteralPath (Join-Path $ModavdOut 'ModAVD.exe') -Destination (Join-Path $root 'ModAVD.exe') -Force
-        Copy-Item -LiteralPath (Join-Path (Get-PackageScripts) 'modavd-bridge.ps1') -Destination (Join-Path $root 'tools\modavd-bridge.ps1') -Force
+        Overlay (Join-Path $Next 'emulator') (Join-Path $Root 'sdk\emulator')
+        Copy-Item -LiteralPath (Join-Path $ModavdOut 'tools\modavd.exe') -Destination (Join-Path $Root 'tools\modavd.exe') -Force
+        Copy-Item -LiteralPath (Join-Path $ModavdOut 'ModAVD.exe') -Destination (Join-Path $Root 'ModAVD.exe') -Force
+        Copy-Item -LiteralPath (Join-Path (Get-PackageScripts) 'modavd-bridge.ps1') -Destination (Join-Path $Root 'tools\modavd-bridge.ps1') -Force
     }
-    $newId = BuildId (Join-Path $root 'sdk\emulator')
-    $missing = @('ModAVD.exe', 'tools\modavd.exe', 'tools\modavd-bridge.ps1') | Where-Object { -not (Test-Path (Join-Path $root $_)) }
+    $newId = BuildId (Join-Path $Root 'sdk\emulator')
+    $missing = @('ModAVD.exe', 'tools\modavd.exe', 'tools\modavd-bridge.ps1') | Where-Object { -not (Test-Path (Join-Path $Root $_)) }
     if ($missing) { $problems += "覆盖后缺：$($missing -join '、')" }
     # SDK 覆盖和不带清单的旧包会留下原清单，不能把它当成新包的版本。
-    $newVersion = if ($nextHasManifest) { PackageVersion $root } else { $null }
+    $newVersion = if ($nextHasManifest) { PackageVersion $Root } else { $null }
     if ($nextHasManifest -and -not $newVersion) { throw '覆盖后缺 modavd-manifest.json' }
     if (-not $nextIsTree) {
         if ($newId -eq $oldId) { $notes += 'SDK 模式，构建号没变，补丁版只换管理器时正常' }
@@ -184,7 +186,7 @@ echo "sdwait=$i"
         if ($newId -eq $oldId) { $problems += "覆盖后构建号还是 $oldId" }
     }
     $notes += "构建号 $oldId -> $newId"
-    $script:CliExe = Join-Path $root 'tools\modavd.exe'
+    $script:CliExe = Join-Path $Root 'tools\modavd.exe'
 
     # ---- 升级后（modavd 自己的宿主输入法那行日志留下来，看是哪次开机装上的）
     $o = Modavd start $Index --no-bridge; $o | Select-Object -Last 1 | ForEach-Object { Say "  $_" }
@@ -218,7 +220,7 @@ echo "sdwait=$i lower=$(cat /data/media/0/Download/upgrade-marker.txt 2>&1)"
     if (-not $checkIme) { $notes += $imeSkip; Say $imeSkip }
     else {
         $want = (Get-FileHash -LiteralPath $imeApk -Algorithm SHA256).Hash.ToLower()
-        $rootApk = Join-Path $root 'components\modavd-ime.apk'
+        $rootApk = Join-Path $Root 'components\modavd-ime.apk'
         $have = if (Test-Path -LiteralPath $rootApk) { (Get-FileHash -LiteralPath $rootApk -Algorithm SHA256).Hash.ToLower() } else { '' }
         $g = SuRun @'
 p=$(pm path org.modavd.ime 2>/dev/null | sed -n 's/^package://p' | grep '/base\.apk$' | head -n 1)
@@ -264,26 +266,17 @@ if [ -e /data/local/tmp/modavd-ime.autoselected ]; then echo mark=1; else echo m
             if ($code -ne 0) { $problems += "收尾删实例试了 30 次都没成（退出码 $code）：$(($o | Select-Object -Last 1))"; Say $problems[-1] }
         }
     }
-    # 这个根目录的私有 adb server 跑完就关：留着会一直占着端口
+    # 测试根是共用的：它的 adb server 和根目录都留着。只删这次的临时目录（新 modavd 的副本、netsim 发现目录）
     if ($made) {
-        foreach ($p in $AdbPort, $ScriptAdbPort) { & (Join-Path $Official 'platform-tools\adb.exe') -P $p kill-server 2>&1 | Out-Null }
-    }
-    if ($made -and -not $Keep) {
-        # 根目录下还有进程在跑就不删：删一半的根目录比留着更难收拾
-        $idle = $true
-        try { WaitRootIdle } catch { $idle = $false; $problems += "收尾时$($_.Exception.Message)，没删 $Work"; Say $problems[-1] }
-        if ($idle) {
-            # 先拆两个目录联接（rmdir 只删联接本身），确认根目录下没有任何重解析点了，才整个删掉：绝不能删进 sdk-official
-            foreach ($n in 'platform-tools', 'system-images') { $j = Join-Path $root "sdk\$n"; if (Test-Path -LiteralPath $j) { cmd /c rmdir "$j" | Out-Null } }
-            $links = @(Get-ChildItem -LiteralPath $Work -Recurse -Force -Attributes ReparsePoint -ErrorAction SilentlyContinue)
-            if ($links) { $problems += "收尾时根目录下还有联接，没删 ${Work}：$($links.FullName -join '、')"; Say $problems[-1] }
-            else {
-                # 模拟器刚退出时日志文件可能还被占着一会儿
-                for ($k = 0; $k -lt 15 -and (Test-Path -LiteralPath $Work); $k++) {
-                    try { Remove-Item -LiteralPath $Work -Recurse -Force -ErrorAction Stop } catch { Start-Sleep 2 }
-                }
-                if (Test-Path -LiteralPath $Work) { $problems += "收尾删了 15 次 $Work 还没删干净"; Say $problems[-1] } else { Say "删掉了 $Work" }
+        $nowVersion = try { PackageVersion $Root } catch { $null }
+        $nowId = try { BuildId (Join-Path $Root 'sdk\emulator') } catch { '?' }
+        $notes += "测试根 $Root 现在是 $(if ($nowVersion) { $nowVersion.Text } else { "构建 $nowId" })（测之前 $(if ($beforeVersion) { $beforeVersion.Text } else { '没有清单' })）"
+        if (-not $Keep) {
+            # netsimd 退出前可能还占着发现目录里的文件
+            for ($k = 0; $k -lt 15 -and (Test-Path -LiteralPath $Work); $k++) {
+                try { Remove-Item -LiteralPath $Work -Recurse -Force -ErrorAction Stop } catch { Start-Sleep 2 }
             }
+            if (Test-Path -LiteralPath $Work) { $problems += "收尾删了 15 次临时目录 $Work 还没删干净"; Say $problems[-1] }
         }
     }
 }
diff --git a/items/yys.ps1 b/items/yys.ps1
index 5432c66..f161d74 100644
--- a/items/yys.ps1
+++ b/items/yys.ps1
@@ -56,7 +56,7 @@ $ErrorActionPreference = 'Stop'
 [cultureinfo]::CurrentCulture = [cultureinfo]::InvariantCulture
 . "$PSScriptRoot\common.ps1"
 . "$PSScriptRoot\fps-baseline.ps1"
-$Root = Use-Local TestRoot $Root '-Root'
+$Root = Resolve-TestRoot (Use-Local TestRoot $Root '-Root')
 if (-not $Out) { $Out = Join-Path (Use-Local TempRoot $null '-Out') 'regress-yys' }
 $MaaRun = Use-Local MaaYYs $MaaRun '-MaaRun'
 Add-Type -AssemblyName System.Drawing
diff --git a/local.example.psd1 b/local.example.psd1
index c660f75..9f03d74 100644
--- a/local.example.psd1
+++ b/local.example.psd1
@@ -2,26 +2,40 @@
 # 或者放在仓库外、用环境变量 MODAVD_E2E_CONFIG 指过去。
 # 留空就是没设：套件里用到它的项不跑（-DryRun 会列出来），单独跑某一项时要你在命令行上给对应参数。路径一律写绝对路径。
 @{
-    # 临时输出的根目录：回归输出默认在 <TempRoot>\regress-<构建>-<时间>，设了以后 -Out 也必须在它下面
+    # 临时输出的根目录：回归输出默认在 <TempRoot>\regress-<构建>-<时间>
     TempRoot     = ''
+    # 测试不碰的根目录：D:\ModAVD（AUTO-MAS 在用的生产根目录）总是算，这里列的在它之外再加，不是替换它。
+    # 你自己日常在用的根目录（不是给回归用的）也写进来，比如 @('E:\testbed\my-own')。测试根、回归输出、工作目录、
+    # 实例目录落在这些根目录下面就停；生产占着的 adb 端口 5037、20049、20050 也一律拒绝
+    ProductionRoots = @()
+    # 回归只许用的测试根（可以不写）：写了就只认列出来的根目录本身，TestRoot、PackageRoot、-Root 指到别处就停；
+    # 不写就不限，只拒绝上面那些
+    TestRoots    = @()
 
     # ---- 被测的东西
-    # 放着 tools\modavd.exe 和 ModAVD.exe 的目录（ModAVDManager 的 build.ps1 -Out，或解开的 Release 包）
-    Manager      = ''
+    # 管理器（放着 tools\modavd.exe 和 ModAVD.exe 的目录）不在这里配：regress.ps1 必须传 -Manager，单独跑某一项时设环境变量
+    # MODAVD_REGRESS_MANAGER。本机留一份旧管理器在配置里，会让不认 portBase 的版本把测试根的实例开到生产的 20000 段上。
     # ModAVD 仓库的 package\（随包脚本，装桥脚本 modavd-bridge.ps1 在里面）；发版回归用发版克隆里的那份
     PackageScripts = ''
     # 上一个生产版的组包目录（升级项的起点，放一份固定副本）
     PrevPackage  = ''
-    # 官方 SDK（platform-tools、system-images），新搭的根目录链到它，代替「补全组件」的下载
-    OfficialSdk  = ''
     # 补全组件的两个 zip（platform-tools_r37.0.1-win.zip、x86_64-34_r14.zip）放在哪个目录；可以不写，fetch 项就从网上下载一次
     ComponentCache = ''
 
     # ---- 测试机
-    # 测试用的 ModAVD 根目录（私有 adb 端口，同机有生产根目录时 mas-avd.json 设 portBase；0 号已装桥、登着测试号，
-    # 其余编号由各项临时建、跑完删）
+    # 测试用的 ModAVD 根目录：E:\testbed 下已有的 flow-a / flow-b（11-05 起回归不新建根目录，实例都建在它们里面）。
+    # mas-avd.json 要设 portBase 和私有 adb 端口；0 号已装桥、登着测试号，其余编号由各项临时建、跑完删
     TestRoot     = ''
+    # 装包类的项（upgrade、ime-pkg）用的测试根：先把它装成要测的包（升级先装回上一版），在里面建临时实例，测完只删实例、
+    # 根目录停在新包上。不写就用 TestRoot
+    PackageRoot  = ''
     # 游戏实例 mas_6 / mas_7 / endfield、星铁实例 gfx_t2、输入法冒烟机 imesmoke 的 ANDROID_AVD_HOME
+    # 游戏实例（game-real）的控制台端口，默认 ark 20072、r1999 20100、sr 20120、ef 20096；要改写成 @{ sr = 20130 } 这样，
+    # 只写要改的游戏。端口和它 +1、+2（adb、gRPC）不能落在生产的 20000–20049 上，也不能是 5037、20049、20050，否则报错停下
+    GamePorts    = @{}
+    # 游戏实例的名字，默认 ark mas_6、r1999 mas_7、sr gfx_t2、ef endfield；testbed 的根里实例按编号叫 mas_<号>，
+    # 写成 @{ r1999 = 'mas_1' } 这样，只写要改的游戏。实例目录（GameAvdHome / SrAvdHome）在生产根目录下就停
+    GameAvds     = @{}
     GameAvdHome  = ''
     SrAvdHome    = ''
     ImeAvdHome   = ''
diff --git a/local.ps1 b/local.ps1
index 7c02eb7..fc3dccf 100644
--- a/local.ps1
+++ b/local.ps1
@@ -43,3 +43,35 @@ function Test-Inside([string]$Path, [string[]]$Roots) {
     }
     return $null
 }
+
+# 不碰的根目录：AUTO-MAS 在用的生产根目录 D:\ModAVD，加上本机配置 ProductionRoots 里列的（用户自己用的根，比如
+# E:\testbed\fsync-user，也写进去）；还有生产占着的 adb server 端口。ProductionRoots 是在 D:\ModAVD 之外再加，不是替换它。
+# 测试只读不写：测试根、回归输出、工作目录、实例目录落在这些根目录下面，或者用到这几个端口，就停。
+$script:DefaultProductionRoot = 'D:\ModAVD'
+$script:ProductionAdbPorts = @(5037, 20049, 20050)
+function Get-ProductionRoots {
+    @(@($script:DefaultProductionRoot) + @(Use-Local ProductionRoots $null '' -Optional | Where-Object { $_ }))
+}
+# 比路径用：不分大小写，\ 和 / 都算分隔符（CI 在 Linux 上跑测试，D:\ 写法的路径也要比得出来）。只算字符串，不读盘
+function Get-NormalPath([string]$Path) { ([IO.Path]::GetFullPath($Path) -replace '[\\/]+', '/').TrimEnd('/').ToLowerInvariant() }
+function Test-UnderPath([string]$Path, [string]$Root) {
+    $p = Get-NormalPath $Path; $r = Get-NormalPath $Root
+    $p -eq $r -or $p.StartsWith($r + '/')
+}
+function Assert-NotProduction([string]$Path, [string]$What) {
+    foreach ($r in Get-ProductionRoots) {
+        if (Test-UnderPath $Path $r) { throw "$What 在生产根目录 $r 下（$Path）：测试不碰生产" }
+    }
+}
+# 测试根白名单（可选）：本机配置 TestRoots 列了，回归就只用列出来的根目录本身（维护者的机器上是 E:\testbed\flow-a、flow-b）；
+# 没列就不限，只拒绝上面那些。
+function Assert-ListedTestRoot([string]$Root, [string]$What) {
+    $listed = @(Use-Local TestRoots $null '' -Optional | Where-Object { $_ })
+    if (-not $listed.Count) { return }
+    $p = Get-NormalPath $Root
+    foreach ($r in $listed) { if ((Get-NormalPath $r) -eq $p) { return } }
+    throw "$What $Root 不在本机配置 TestRoots 里（$($listed -join '、')）：回归只用列出来的测试根"
+}
+function Assert-NotProductionPort([int]$Port, [string]$What) {
+    if ($Port -in $script:ProductionAdbPorts) { throw "$What 是 $Port，是生产在用的 adb 端口（$($script:ProductionAdbPorts -join '、')）" }
+}
diff --git a/regress.ps1 b/regress.ps1
index 562ea1a..5b7952c 100644
--- a/regress.ps1
+++ b/regress.ps1
@@ -25,14 +25,14 @@ param(
     [string]$Baseline,
     # 默认取 SDK 的 Pkg.BuildId（mas-36 -> mas36）
     [string]$Label,
-    # 默认 <TempRoot>\regress-<Label>-<时间>；本机配置有 TempRoot 时必须在它下面
+    # 默认 <TempRoot>\regress-<Label>-<时间>；不能在生产根目录（本机配置 ProductionRoots，默认 D:\ModAVD）下
     [string]$Out,
     # 这一版改了什么（套件 Scopes 里的名字）
     [string[]]$Scope,
     [string[]]$Only,
     [string[]]$Skip,
-    # 管理器：放着 tools\modavd.exe 和 ModAVD.exe 的目录（ModAVDManager 的 build.ps1 -Out，或解开的 Release 包；
-    # 本机配置 Manager）；发版回归用要随包发的那一版。随包脚本：ModAVD 仓库的 package\（本机配置 PackageScripts），
+    # 管理器：必须给，放着 tools\modavd.exe 和 ModAVD.exe 的目录（ModAVDManager 的 build.ps1 -Out，或解开的 Release 包），
+    # 不从本机配置取：回归用的就是要随包发的那一版，拿本机留着的旧版会让测试根的实例开到生产的端口段上。随包脚本：ModAVD 仓库的 package\（本机配置 PackageScripts），
     # 发版回归用发版克隆里的那份。两个都经环境变量（MODAVD_REGRESS_MANAGER / MODAVD_REGRESS_PACKAGE）传给各项，见 items\common.ps1
     [string]$Manager,
     [string]$PackageScripts,
@@ -42,7 +42,8 @@ $ErrorActionPreference = 'Stop'
 [cultureinfo]::CurrentCulture = [cultureinfo]::InvariantCulture
 . (Join-Path $PSScriptRoot 'local.ps1')
 $Repo = $PSScriptRoot
-$Manager = (Resolve-Path (Use-Local Manager $Manager '-Manager')).Path
+if (-not $Manager) { throw '没给 -Manager：要传发版用的那个管理器目录（放着 tools\modavd.exe 和 ModAVD.exe，即解开的 ModAVDManager Release 包或 build.ps1 -Out）。不从本机配置取，旧版管理器不认 portBase，会把测试根的实例开到生产的 20000 段上' }
+$Manager = (Resolve-Path $Manager).Path
 $PackageScripts = (Resolve-Path (Use-Local PackageScripts $PackageScripts '-PackageScripts')).Path
 foreach ($f in (Join-Path $Manager 'tools\modavd.exe'), (Join-Path $Manager 'ModAVD.exe'), (Join-Path $PackageScripts 'modavd-bridge.ps1')) {
     if (-not (Test-Path -LiteralPath $f)) { throw "没有 $f（-Manager / -PackageScripts）" }
@@ -64,11 +65,19 @@ if (-not $Label) {
     $Label = $id -replace '-', ''
 }
 $suiteData = Import-PowerShellDataFile -LiteralPath $Suite
-# 临时数据只放临时目录：本机配置有 TempRoot 时输出必须在它下面
-$tempRoot = Use-Local TempRoot $null '' -Optional
+# 输出默认放临时目录（本机配置 TempRoot）；放哪都行，只是不能在生产根目录（含 ProductionRoots 列的用户的根）下
 if (-not $Out) { $Out = Join-Path (Use-Local TempRoot $null '-Out') "regress-$Label-$(Get-Date -Format 'yyyyMMdd-HHmmss')" }
 $Out = [IO.Path]::GetFullPath($Out)
-if ($tempRoot -and -not (Test-Inside $Out @($tempRoot))) { throw "输出要在临时目录 $tempRoot（本机配置 TempRoot）下面：$Out" }
+Assert-NotProduction $Out '回归输出'
+# 本机配置的测试根（实例都建在它们里面，不新建根目录）和绕过管理器直接开机的几台的实例目录：开跑前就核，不等到哪一项才停
+foreach ($key in 'TestRoot', 'PackageRoot') {
+    $configured = Use-Local $key $null '' -Optional
+    if ($configured) { Assert-NotProduction $configured "本机配置的 $key"; Assert-ListedTestRoot $configured "本机配置的 $key" }
+}
+foreach ($key in 'GameAvdHome', 'SrAvdHome', 'ImeAvdHome') {
+    $configured = Use-Local $key $null '' -Optional
+    if ($configured) { Assert-NotProduction $configured "本机配置的 $key" }
+}
 
 $items = @($suiteData.Items)
 $ids = $items | ForEach-Object { $_.Id }
@@ -394,9 +403,10 @@ foreach ($it in $items) {
     if (-not (WaitRes $it)) { $r.status = '跳过'; $r.summary = '资源一直不够'; L "[$($it.Id)] 跳过：资源一直不够"; $results.Add([pscustomobject]$r); continue }
     # Item arguments can override the local configuration's root/AVD home.
     $itemRoot = Use-Local TestRoot $null '' -Optional
-    $itemHomes = @(foreach ($key in 'GameAvdHome', 'SrAvdHome', 'ImeAvdHome') {
+    $itemHomes = @(foreach ($key in 'GameAvdHome', 'SrAvdHome', 'ImeAvdHome', 'PackageRoot') {
             $value = Use-Local $key $null '' -Optional
-            if ($value) { $value }
+            # PackageRoot 是根目录，实例在它的 avd 下
+            if ($value) { if ($key -eq 'PackageRoot') { Join-Path $value 'avd' } else { $value } }
         })
     for ($i = 0; $i -lt $argv.Count - 1; $i++) {
         switch ($argv[$i]) {
diff --git a/suites/release.psd1 b/suites/release.psd1
index 7668481..bd29737 100644
--- a/suites/release.psd1
+++ b/suites/release.psd1
@@ -3,7 +3,9 @@
 # 占位符：{Sdk} {Baseline} {Label} {Out} {ItemOut} {Repo}，{Local:<键名>} 取本机配置。每项字段见 README.md。
 # 用到的测试机（都是测试数据，不是生产；位置在本机配置里）：
 #   mas_6 / mas_7 / endfield：GameAvdHome（体检、明日方舟、1999、终末地）；gfx_t2：SrAvdHome（星铁）；
-#   imesmoke：ImeAvdHome（输入法）；TestRoot 的 0 号（阴阳师，已装桥、已登录）和临时新建的 3、6、7 号。
+#   imesmoke：ImeAvdHome（输入法）；TestRoot 的 0 号（阴阳师，已装桥、已登录）和临时新建的 3、6、7 号；
+#   PackageRoot（没有就 TestRoot）里临时新建的 8、9 号（upgrade、ime-pkg）。11-05 起不新建根目录：都是 E:\testbed 下已有的根，
+#   生产根目录 D:\ModAVD 和本机配置 ProductionRoots 另列的根（用户自己用的）一律拒绝；写了 TestRoots 时只认列出来的。
 @{
     Avds  = @('mas_0', 'mas_3', 'mas_4', 'mas_6', 'mas_7', 'gfx_t2', 'imesmoke', 'endfield')
     Scopes = @{
@@ -66,8 +68,8 @@
             TimeoutMin = 60
         }
         @{
-            Id = 'r1999'; Title = '《重返未来：1999》M9A：启动游戏 + 智能均衡刷材料 15 分钟（装桥，耗体力一天一轮）'
-            Criterion = 'M9A 启动游戏成功、刷材料成功或到时间停；游戏不重启；无 native crash / ANR / Vulkan 报错 / 新转储；帧率不低于上一版基准超过容差'
+            Id = 'r1999'; Title = '《重返未来：1999》M9A：启动游戏 + 常规作战打资源本 15 分钟（装桥，耗体力一天一轮）'
+            Criterion = 'M9A 启动游戏成功、常规作战成功或到时间停，而且真打了（不到 2 分钟就结束算没打）；游戏不重启；无 native crash / ANR / Vulkan 报错 / 新转储；帧率不低于上一版基准超过容差'
             Scopes = @('emulator')
             Script = '{Repo}\items\game-real.ps1'
             Args = @('-Game', 'r1999', '-Sdk', '{Sdk}', '-Out', '{ItemOut}')
diff --git a/tests/m9a-verdict.ps1 b/tests/m9a-verdict.ps1
new file mode 100644
index 0000000..d71ef63
--- /dev/null
+++ b/tests/m9a-verdict.ps1
@@ -0,0 +1,71 @@
+# 1999 那一项（items\game-real.ps1 -Game r1999）怎么判驱动：用 -ReJudge 按造好的驱动输出重判，不开机、不连 adb。
+# 11-05：M9A 4.11.1 的「智能均衡刷材料」什么都不打就「成功」退出，回归里 0.6 分钟就结束的那几次其实没打；
+# 现在驱动打「常规作战」。11-06 起驱动打出打了几次（combat rounds: N），按次数判，0 次算没打到战斗；
+# 旧驱动没有这一行时才按时长判：不到 2 分钟就结束（又不是到时间停）算没打到战斗。
+$ErrorActionPreference = 'Stop'
+$count = 0
+function Check([bool]$ok, [string]$message) {
+    $script:count++
+    if (-not $ok) { throw $message }
+}
+$work = Join-Path ([IO.Path]::GetTempPath()) "m9a-verdict-$([guid]::NewGuid().ToString('N'))"
+$sdkDir = Join-Path $work 'sdk'
+New-Item -ItemType Directory -Force $sdkDir | Out-Null
+$runner = Join-Path $PSScriptRoot '..\items\game-real.ps1'
+# 不读维护者的本机配置
+$env:MODAVD_E2E_CONFIG = $null
+
+function Verdict([string]$name, [string[]]$driver) {
+    $out = Join-Path $work $name
+    $round = Join-Path $out 'r1999-on'
+    New-Item -ItemType Directory -Force $round | Out-Null
+    Set-Content -LiteralPath (Join-Path $round 'driver.txt') -Value $driver -Encoding utf8
+    [pscustomobject]@{ code = 0; timedOut = $false; alive = $true; newDumps = 0; abi = 'x86_64'; uninstall = $null; others = 0; perf = $null } |
+        ConvertTo-Json | Set-Content -LiteralPath (Join-Path $round 'round.json') -Encoding utf8
+    $lines = @(pwsh -NoProfile -File $runner -Game r1999 -Sdk $sdkDir -Out $out -ReJudge 2>&1 | ForEach-Object { "$_" })
+    $result = $lines | Where-Object { $_.StartsWith('REGRESS-RESULT ') } | Select-Object -Last 1
+    Check ([bool]$result) "$name：没有 REGRESS-RESULT 行：$($lines -join ' | ')"
+    ($result.Substring('REGRESS-RESULT '.Length) | ConvertFrom-Json).summary
+}
+
+try {
+    $start = '12:00:00 done  启动游戏: succeeded in 1.2 min'
+    $s = Verdict 'no-stamina' @($start, '12:01:00 start 常规作战', '12:01:30 done  常规作战: succeeded in 0.6 min', '12:01:30 all finished in 1.8 min')
+    Check ($s -match '0\.6 分钟就结束，没打到战斗') "一进去就「成功」退出的要判成没打：$s"
+    Check ($s -match '问题：.*没打到战斗') "没打到战斗要算问题：$s"
+    $s = Verdict 'fought' @($start, '12:01:00 start 常规作战', '12:04:24 done  常规作战: succeeded in 3.4 min', '12:04:24 all finished in 4.6 min')
+    Check ($s -match 'M9A 常规作战 succeeded，3\.4 分钟' -and $s -notmatch '没打到') "打完 3.4 分钟的要算驱动过：$s"
+    $s = Verdict 'budget' @($start, '12:01:00 start 常规作战', '12:16:00 budget 15 min reached, stopping', '12:16:01 done  常规作战: FAILED in 15.0 min', '12:16:01 all finished in 16.2 min (budget stop)')
+    Check ($s -match 'M9A 常规作战 FAILED（到时间停），15\.0 分钟' -and $s -notmatch '没打到') "到时间停的要算驱动过：$s"
+    $s = Verdict 'short-budget' @($start, '12:01:00 start 常规作战', '12:01:40 budget 1 min reached, stopping', '12:01:41 done  常规作战: FAILED in 0.7 min', '12:01:41 all finished in 1.9 min (budget stop)')
+    Check ($s -notmatch '没打到') "到时间停的不按时长判：$s"
+    $s = Verdict 'failed' @($start, '12:01:00 start 常规作战', '12:09:00 done  常规作战: FAILED in 8.0 min', '12:09:00 all finished in 9.2 min')
+    Check ($s -match '问题：.*M9A 常规作战 FAILED') "常规作战失败要算问题：$s"
+    $s = Verdict 'old-task' @($start, '12:01:00 start 智能均衡刷材料', '12:01:36 done  智能均衡刷材料: succeeded in 0.6 min')
+    Check ($s -match 'M9A 常规作战没跑') "旧任务的输出不能当成打过：$s"
+    $s = Verdict 'no-start' @('12:00:00 done  启动游戏: FAILED in 3.0 min')
+    Check ($s -match 'M9A 启动游戏没成功') "启动游戏没成功要报：$s"
+    # 驱动 11-06 起打出打了几次：按次数判，不按时长（11-06 实跑：体力 32、一次 25，复现 1 次，1.1 分钟）
+    $s = Verdict 'one-round' @($start, '12:01:00 start 常规作战', '12:02:06 done  常规作战: succeeded in 1.1 min', '12:02:06 combat rounds: 1', '12:02:06 stamina: 32 -> 7 (stage 25)', '12:02:07 all finished in 2.4 min')
+    Check ($s -match 'M9A 常规作战 succeeded，打了 1 次，1\.1 分钟，体力 32 → 7（一次 25）' -and $s -notmatch '没打') "体力只够一次、1.1 分钟就结束的也算打了：$s"
+    $s = Verdict 'zero-rounds' @($start, '12:01:00 start 常规作战', '12:01:30 done  常规作战: succeeded in 0.5 min', '12:01:30 combat rounds: 0', '12:01:30 stamina: 7 -> 7 (stage 25)')
+    Check ($s -match '问题：.*一次都没打（体力不够') "打了 0 次要算没打：$s"
+    $s = Verdict 'zero-rounds-long' @($start, '12:01:00 start 常规作战', '12:05:00 done  常规作战: succeeded in 4.0 min', '12:05:00 combat rounds: 0')
+    Check ($s -match '问题：.*一次都没打') "打了 0 次就算用时长也是没打：$s"
+    $s = Verdict 'zero-rounds-budget' @($start, '12:01:00 start 常规作战', '12:16:00 budget 15 min reached, stopping', '12:16:01 done  常规作战: FAILED in 15.0 min', '12:16:01 combat rounds: 0', '12:16:01 all finished in 16.2 min (budget stop)')
+    Check ($s -match '问题：.*一次都没打（到时间停了也没打完一次）') "到时间停、一次都没打完的要算问题：$s"
+    $s = Verdict 'rounds-budget' @($start, '12:01:00 start 常规作战', '12:16:00 budget 15 min reached, stopping', '12:16:01 done  常规作战: FAILED in 15.0 min', '12:16:01 combat rounds: 9', '12:16:01 all finished in 16.2 min (budget stop)')
+    Check ($s -match 'M9A 常规作战 FAILED（到时间停），打了 9 次，15\.0 分钟' -and $s -notmatch '问题：.*(驱动|没打|一次都没)') "到时间停、打了几次的算过：$s"
+    $s = Verdict 'rounds-unknown' @($start, '12:01:00 start 常规作战', '12:01:30 done  常规作战: succeeded in 0.6 min', '12:01:30 combat rounds: unknown')
+    Check ($s -match '0\.6 分钟就结束，没打到战斗') "驱动找不到 M9A 日志（unknown）时退回按时长判：$s"
+    # 吃糖次数是参数，不再写死
+    $text = Get-Content -LiteralPath $runner -Raw
+    Check ($text -match '\[ValidateRange\(0, 10\)\]\[int\]\$M9ACandy = 0') 'game-real.ps1 要有 -M9ACandy（0–10，默认 0）'
+    Check ($text -match '\$env:M9A_CANDY = "\$M9ACandy"') 'r1999 驱动要拿到 M9A_CANDY'
+    Check ($text -notmatch "done  智能均衡刷材料") '判法里不该还认智能均衡刷材料'
+    Write-Host "m9a verdict: $count checks passed"
+} finally {
+    Remove-Item -LiteralPath $work -Recurse -Force -ErrorAction SilentlyContinue
+}
+# 上面调过故意失败的子进程；CI 的 pwsh 步骤会把最后的 $LASTEXITCODE 当成退出码
+exit 0
diff --git a/tests/root-guards.ps1 b/tests/root-guards.ps1
new file mode 100644
index 0000000..ef69284
--- /dev/null
+++ b/tests/root-guards.ps1
@@ -0,0 +1,233 @@
+# 测试根的守卫（11-05）：回归只用已有的测试根（E:\testbed 下的 flow-a / flow-b），不新建根目录；生产根目录 D:\ModAVD 和
+# 生产占着的 adb 端口 5037 / 20049 / 20050 一律拒绝；本机配置 ProductionRoots 在 D:\ModAVD 之外再加（用户自己用的根），
+# TestRoots（可选）写了就只认列出来的测试根。不开模拟器、不连 adb。
+#   pwsh -NoProfile -File tests/root-guards.ps1
+#
+# 这个测试绝不碰真的生产根目录，被测代码的守卫就算坏了（变异检查会故意弄坏）也一样：
+#  - 「默认是 D:\ModAVD」只在最前面用字符串比一比（GetFullPath 只算字符串，不读盘），不把它交给任何会读写文件的函数；
+#  - 其余凡是「生产根目录」都是临时目录里造的假根，用本机配置 ProductionRoots 指过去；
+#  - 管理器、随包脚本指到临时目录里不存在的路径：没有任何真程序可跑（也不造假 exe，会在桌面弹窗）。
+# 11-05 22:07 的教训：上一版把真的 D:\ModAVD 传给了脚本，变异检查去掉守卫时脚本跑了生产里的 modavd.exe list，
+# 碰了生产 avd 下的 5 个锁文件。
+$ErrorActionPreference = 'Stop'
+$script:count = 0
+function Check([bool]$ok, [string]$message) { $script:count++; if (-not $ok) { throw $message } }
+function Throws([scriptblock]$Block) { try { & $Block | Out-Null } catch { return "$($_.Exception.Message)" }; return $null }
+# 目录里的每个文件（路径、长度、修改时间、内容哈希）。不比目录本身的修改时间：刚写完文件时系统会稍后再刷新它
+# 子进程的输出拼成一行：报错按控制台宽度折行，续行带「     | 」前缀，长路径会把「在生产根目录 … 下」拆到两行
+# （折行处的空格会被吃掉，所以下面的正则写「在生产根目录\s*」）
+# CI（Linux）上报错还带 ANSI 颜色码，夹在字中间，先去掉
+function Join-Output($Lines) { (((@($Lines) | ForEach-Object { "$_" }) -join "`n") -replace '\x1b\[[0-9;?]*[A-Za-z]', '') -replace '\r?\n\s*\|\s?', '' }
+function Snapshot([string]$Dir) { (Get-ChildItem -LiteralPath $Dir -Recurse -Force -File | ForEach-Object { "$($_.FullName)|$($_.Length)|$($_.LastWriteTimeUtc.Ticks)|$((Get-FileHash -LiteralPath $_.FullName).Hash)" } | Sort-Object) -join "`n" }
+
+$temp = [IO.Path]::GetTempPath()
+$work = Join-Path $temp "root-guards-$([guid]::NewGuid().ToString('N'))"
+New-Item -ItemType Directory -Force $work | Out-Null
+$config = Join-Path $work 'local.psd1'
+Set-Content -LiteralPath $config -Value '@{}' -Encoding utf8
+$saved = @{}
+foreach ($k in 'MODAVD_E2E_CONFIG', 'MODAVD_REGRESS_MANAGER', 'MODAVD_REGRESS_PACKAGE') { $saved[$k] = [Environment]::GetEnvironmentVariable($k) }
+$env:MODAVD_E2E_CONFIG = $config
+$env:MODAVD_REGRESS_MANAGER = Join-Path $work 'no-manager'
+$env:MODAVD_REGRESS_PACKAGE = Join-Path $work 'no-package'
+try {
+    . (Join-Path $PSScriptRoot '..\items\common.ps1')
+    # 拼输出的小工具本身：折行的续行前缀、颜色码都去掉
+    $esc = [char]27
+    Check ((Join-Output @("A 在生产根目录", "     | X 下")) -eq 'A 在生产根目录X 下') 'Join-Output 要去掉续行前缀'
+    Check ((Join-Output @("${esc}[31;1mA ${esc}[0m在生产根目录", "${esc}[36;1m     | ${esc}[31;1mX 下${esc}[0m")) -eq 'A 在生产根目录X 下') 'Join-Output 要去掉颜色码'
+
+    # ---- 默认的生产根目录 D:\ModAVD：只比字符串。不分大小写，\ 和 / 都认，下面的目录也算
+    foreach ($bad in 'D:\ModAVD', 'd:\modavd\avd\mas_1.avd', 'D:/ModAVD/tools', 'D:\ModAVD\') {
+        $m = Throws { Assert-NotProduction $bad '测试根' }
+        Check ($m -and $m -match '在生产根目录 .+ 下') "生产根目录 $bad 应该被拒，得到：$m"
+    }
+    foreach ($ok in 'E:\testbed\flow-a', 'D:\ModAVD2', 'D:\Other\ModAVD', (Join-Path $work 'x')) {
+        Check (-not (Throws { Assert-NotProduction $ok '测试根' })) "$ok 不是生产根目录，不该被拒"
+    }
+
+    # ---- 从这里起「生产根目录」都是这个假根（临时目录里），用本机配置 ProductionRoots 指过去
+    $fakeProd = Join-Path $work 'prod'
+    if (-not $fakeProd.StartsWith($temp, [StringComparison]::OrdinalIgnoreCase)) { throw "假的生产根目录要在临时目录里：$fakeProd" }
+    New-Item -ItemType Directory -Force (Join-Path $fakeProd 'avd') | Out-Null
+    Set-Content -LiteralPath (Join-Path $fakeProd 'mas-avd.json') -Value '{"adbServerPort": 20049, "scriptAdbServerPort": 20050, "instances": {}}' -Encoding utf8
+    @{ version = 'v0.38.0'; files = @{ 'tools/modavd-bridge.ps1' = @{ size = 1; sha256 = 'x' } } } | ConvertTo-Json -Depth 4 |
+        Set-Content -LiteralPath (Join-Path $fakeProd 'modavd-manifest.json') -Encoding utf8
+    New-Item -ItemType Directory -Force (Join-Path $fakeProd 'tools') | Out-Null
+    Set-Content -LiteralPath (Join-Path $fakeProd 'tools\modavd-bridge.ps1') -Value '# fake' -Encoding utf8
+    $q = { param($s) "'" + ($s -replace "'", "''") + "'" }
+    $baseConfig = "@{ ProductionRoots = @($(& $q $fakeProd)) }"
+    function Use-Config([string]$Text) { Set-Content -LiteralPath $config -Value $Text -Encoding utf8; $script:ModAVDLocal = $null }
+    Use-Config $baseConfig
+    $prodBefore = Snapshot $fakeProd
+    Check ([bool](Throws { Assert-NotProduction (Join-Path $fakeProd 'x') '测试根' })) 'ProductionRoots 配的根目录要被拒'
+    # ProductionRoots 是在 D:\ModAVD 之外再加，不是替换（11-06 审查：只写 fsync-user 时生产反而没人拦了）。只比字符串
+    foreach ($bad in 'D:\ModAVD', 'd:/modavd/avd') {
+        Check ([bool](Throws { Assert-NotProduction $bad '测试根' })) "配了 ProductionRoots 以后 $bad 照样被拒"
+    }
+    # 用户自己用的根（维护者机器上的 fsync-user）写进 ProductionRoots 就被拒；只写一个字符串、不写成数组也认
+    $userRoot = Join-Path $work 'user-root'
+    Use-Config "@{ ProductionRoots = @($(& $q $fakeProd), $(& $q $userRoot)) }"
+    Check ([bool](Throws { Assert-NotProduction (Join-Path $userRoot 'avd') '测试根' })) 'ProductionRoots 列的用户的根要被拒'
+    Check ([bool](Throws { Assert-NotProduction (Join-Path $fakeProd 'avd') '测试根' })) '列了两个时第一个照样被拒'
+    Check ([bool](Throws { Assert-NotProduction 'D:\ModAVD' '测试根' })) '列了两个时 D:\ModAVD 照样被拒'
+    Use-Config "@{ ProductionRoots = $(& $q $userRoot) }"
+    Check ([bool](Throws { Assert-NotProduction $userRoot '测试根' })) 'ProductionRoots 写成一个字符串也认'
+    Check ([bool](Throws { Assert-NotProduction 'D:\ModAVD\tools' '测试根' })) 'ProductionRoots 写成一个字符串时 D:\ModAVD 照样被拒'
+    Use-Config $baseConfig
+
+    # ---- 生产的 adb 端口
+    foreach ($p in 5037, 20049, 20050) { Check ([bool](Throws { Assert-NotProductionPort $p 'adb' })) "端口 $p 应该被拒" }
+    foreach ($p in 20089, 31099, 21099) { Check (-not (Throws { Assert-NotProductionPort $p 'adb' })) "端口 $p 不该被拒" }
+
+    # ---- Resolve-TestRoot：只认已有的根目录
+    $m = Throws { Resolve-TestRoot $fakeProd }
+    Check ($m -match '在生产根目录 .+ 下') "传生产根目录要被拒：$m"
+    $m = Throws { Resolve-TestRoot '' }
+    Check ($m -match '没有测试根') "没给测试根要报：$m"
+    $bare = Join-Path $work 'not-a-root'
+    New-Item -ItemType Directory -Force $bare | Out-Null
+    $m = Throws { Resolve-TestRoot $bare }
+    Check ($m -match '不新建根目录') "没有 mas-avd.json 的目录不能当测试根（回归不新建根目录）：$m"
+    $prodPorts = Join-Path $work 'prod-ports'
+    New-Item -ItemType Directory -Force $prodPorts | Out-Null
+    Set-Content -LiteralPath (Join-Path $prodPorts 'mas-avd.json') -Value '{"portBase": 31000, "adbServerPort": 20049, "scriptAdbServerPort": 31098}' -Encoding utf8
+    $m = Throws { Resolve-TestRoot $prodPorts }
+    Check ($m -match '20049') "测试根的 adb 端口是生产的 20049 要被拒：$m"
+    $flow = Join-Path $work 'flow-x'
+    New-Item -ItemType Directory -Force (Join-Path $flow 'avd') | Out-Null
+    Set-Content -LiteralPath (Join-Path $flow 'mas-avd.json') -Value '{"portBase": 31000, "adbServerPort": 31099, "scriptAdbServerPort": 31098}' -Encoding utf8
+    Check ((Resolve-TestRoot $flow) -eq [IO.Path]::GetFullPath($flow)) '已有的测试根应该原样返回完整路径'
+    # 两个 adb server 端口都要写（没写时管理器用生产的 20050 / 20049）
+    foreach ($case in @(@('no-script-port', '{"portBase": 31000, "adbServerPort": 31099}', 'scriptAdbServerPort'),
+            @('no-adb-port', '{"portBase": 31000, "scriptAdbServerPort": 31098}', 'adbServerPort'),
+            @('zero-adb-port', '{"portBase": 31000, "adbServerPort": 0, "scriptAdbServerPort": 31098}', 'adbServerPort'))) {
+        $r = Join-Path $work $case[0]
+        New-Item -ItemType Directory -Force $r | Out-Null
+        Set-Content -LiteralPath (Join-Path $r 'mas-avd.json') -Value $case[1] -Encoding utf8
+        $m = Throws { Resolve-TestRoot $r }
+        Check ($m -match "没写 $($case[2])") "测试根的 mas-avd.json 没写 $($case[2]) 要被拒：$m"
+    }
+
+    # ---- 换包：只删上一个包里有、新包里没有的文件，不碰实例和配置
+    Check (@(Get-StalePackageFiles @('a', 'b', 'sub/c') @('a', 'sub/d')) -join ',' -eq 'b,sub/c') '要删的是旧清单有、新清单没有的'
+    Check (@(Get-StalePackageFiles $null @('a')).Count -eq 0) '根目录没有清单时什么都不删'
+    $pkgA = Join-Path $work 'pkg-a'; $pkgB = Join-Path $work 'pkg-b'
+    foreach ($x in @(@($pkgA, @{ 'a.txt' = 'A1'; 'tools/old.ps1' = 'old' }), @($pkgB, @{ 'a.txt' = 'A2'; 'tools/new.ps1' = 'new' }))) {
+        $files = [ordered]@{}
+        foreach ($kv in $x[1].GetEnumerator()) {
+            $p = Join-Path $x[0] $kv.Key; New-Item -ItemType Directory -Force (Split-Path $p) | Out-Null
+            Set-Content -LiteralPath $p -Value $kv.Value -Encoding utf8 -NoNewline
+            $files[$kv.Key] = @{ size = 1; sha256 = 'x' }
+        }
+        @{ version = 'v0.0.1'; files = $files } | ConvertTo-Json -Depth 4 | Set-Content -LiteralPath (Join-Path $x[0] 'modavd-manifest.json') -Encoding utf8
+    }
+    # 不往生产根目录装包（这一步在复制之前就停；robocopy 只在 Windows 上有，所以放在 Windows 判断外面，先测拒绝）
+    $m = Throws { Install-Package $pkgA $fakeProd }
+    Check ($m -match '在生产根目录 .+ 下') "不往生产根目录装包：$m"
+    if ($IsWindows) {
+        Set-Content -LiteralPath (Join-Path $flow 'avd\mas_1.ini') -Value 'keep' -Encoding utf8
+        Install-Package $pkgA $flow | Out-Null
+        Check (Test-Path (Join-Path $flow 'tools\old.ps1')) '装上旧包后 tools\old.ps1 在'
+        $removed = @(Install-Package $pkgB $flow)
+        Check (($removed -join ',') -eq 'tools/old.ps1') "换成新包要删掉旧包独有的 tools/old.ps1，实际删了：$($removed -join ',')"
+        Check (-not (Test-Path (Join-Path $flow 'tools\old.ps1'))) '旧包独有的文件删掉了'
+        Check ((Get-Content -LiteralPath (Join-Path $flow 'a.txt') -Raw) -eq 'A2') '两个包都有的文件换成新包的'
+        Check (Test-Path (Join-Path $flow 'tools\new.ps1')) '新包的文件装上了'
+        Check ((Test-Path (Join-Path $flow 'avd\mas_1.ini')) -and (Test-Path (Join-Path $flow 'mas-avd.json'))) '实例和 mas-avd.json 不动'
+    }
+    # 根目录的清单写错了（带 ..、绝对路径、列了实例 / 日志 / 配置）：一个文件都不删就停（在复制之前，所以不分平台）
+    $badRoot = Join-Path $work 'bad-manifest'
+    New-Item -ItemType Directory -Force (Join-Path $badRoot 'tools') | Out-Null
+    Set-Content -LiteralPath (Join-Path $badRoot 'mas-avd.json') -Value '{"portBase": 31000, "adbServerPort": 31099, "scriptAdbServerPort": 31098}' -Encoding utf8
+    foreach ($badRel in '../evil.txt', 'tools/../../evil.txt', '/abs/evil.txt', 'avd/mas_1.avd/config.ini', 'AVD\mas_1.ini', 'logs/x.log', 'mas-avd.json', 'Mas-Avd.json') {
+        Set-Content -LiteralPath (Join-Path $badRoot 'tools\stale.ps1') -Value 'stale' -Encoding utf8
+        $list = [ordered]@{ 'tools/stale.ps1' = @{ size = 1; sha256 = 'x' }; $badRel = @{ size = 1; sha256 = 'x' } }
+        @{ version = 'v0.0.0'; files = $list } | ConvertTo-Json -Depth 4 | Set-Content -LiteralPath (Join-Path $badRoot 'modavd-manifest.json') -Encoding utf8
+        $m = Throws { Install-Package $pkgA $badRoot }
+        Check ($m -match '清单里的路径不对|清单里列了实例、日志或配置') "根目录清单里有 $badRel 时要停：$m"
+        Check (Test-Path (Join-Path $badRoot 'tools\stale.ps1')) "根目录清单里有 $badRel 时一个文件都不该删"
+    }
+    # 测试根白名单（本机配置 TestRoots，可选）：列了就只认列出来的根目录本身
+    $other = Join-Path $work 'flow-y'
+    New-Item -ItemType Directory -Force $other | Out-Null
+    Set-Content -LiteralPath (Join-Path $other 'mas-avd.json') -Value '{"portBase": 31100, "adbServerPort": 31199, "scriptAdbServerPort": 31198}' -Encoding utf8
+    Check ((Resolve-TestRoot $other) -eq [IO.Path]::GetFullPath($other)) '没配 TestRoots 时已有的根都认'
+    Use-Config "@{ ProductionRoots = @($(& $q $fakeProd)); TestRoots = @($(& $q $flow)) }"
+    Check ((Resolve-TestRoot $flow) -eq [IO.Path]::GetFullPath($flow)) 'TestRoots 列了的根照常'
+    Check (-not (Throws { Resolve-TestRoot "$flow/" })) 'TestRoots 列了的根带个分隔符也认'
+    $m = Throws { Resolve-TestRoot $other }
+    Check ($m -match 'TestRoots') "TestRoots 没列的根要被拒：$m"
+    $m = Throws { Resolve-TestRoot (Join-Path $flow 'avd') }
+    Check ($m -match 'TestRoots') "TestRoots 列的根下面的目录也不算：$m"
+    $m = Throws { Install-Package $pkgA $other }
+    Check ($m -match 'TestRoots') "不往 TestRoots 没列的根装包：$m"
+    Use-Config "@{ ProductionRoots = @($(& $q $fakeProd)); TestRoots = $(& $q $flow) }"
+    Check ((Throws { Resolve-TestRoot $other }) -match 'TestRoots') 'TestRoots 写成一个字符串也认'
+    Use-Config $baseConfig
+
+    # ---- 各项脚本拿（假的）生产根目录当测试根：一开始就停，什么都不做
+    $items = Join-Path $PSScriptRoot '..\items'
+    $runs = @(
+        @{ Name = 'upgrade'; Args = @('-File', (Join-Path $items 'upgrade.ps1'), '-Next', $pkgB, '-Prev', $pkgA, '-Root', $fakeProd, '-Work', (Join-Path $work 'up')) }
+        @{ Name = 'ime-pkg'; Args = @('-File', (Join-Path $items 'ime-pkg.ps1'), '-Package', $pkgB, '-Root', $fakeProd, '-Work', (Join-Path $work 'ime')) }
+        @{ Name = 'created-disk-usage'; Args = @('-File', (Join-Path $items 'created-disk-usage.ps1'), '-Action', 'Create', '-Work', (Join-Path $work 'cdu'), '-Root', $fakeProd) }
+        @{ Name = 'bridge'; Args = @('-File', (Join-Path $items 'bridge.ps1'), '-Sdk', $work, '-Root', $fakeProd) }
+        @{ Name = 'datadisk'; Args = @('-File', (Join-Path $items 'datadisk.ps1'), '-Sdk', $work, '-Root', $fakeProd) }
+        @{ Name = 'bridge-default'; Args = @('-File', (Join-Path $items 'bridge-default.ps1'), '-Sdk', $work, '-Root', $fakeProd) }
+        @{ Name = 'yys'; Args = @('-File', (Join-Path $items 'yys.ps1'), '-Sdk', $work, '-Out', (Join-Path $work 'yys-out'), '-Root', $fakeProd) }
+        @{ Name = 'upgrade（新建根目录）'; Args = @('-File', (Join-Path $items 'upgrade.ps1'), '-Next', $pkgB, '-Prev', $pkgA, '-Root', $bare, '-Work', (Join-Path $work 'up2')) }
+        # 测试根是好的，工作目录 / 输出目录落在生产根目录下
+        @{ Name = 'upgrade（-Work 在生产根目录下）'; Args = @('-File', (Join-Path $items 'upgrade.ps1'), '-Next', $pkgB, '-Prev', $pkgA, '-Root', $flow, '-Work', (Join-Path $fakeProd 'up')) }
+        @{ Name = 'ime-pkg（-Work 在生产根目录下）'; Args = @('-File', (Join-Path $items 'ime-pkg.ps1'), '-Package', $pkgB, '-Root', $flow, '-Work', (Join-Path $fakeProd 'ime')) }
+        @{ Name = 'fetch（-Work 在生产根目录下）'; Args = @('-File', (Join-Path $items 'fetch.ps1'), '-Package', $pkgB, '-Work', (Join-Path $fakeProd 'fetch')) }
+        @{ Name = 'created-disk-usage（-Work 在生产根目录下）'; Args = @('-File', (Join-Path $items 'created-disk-usage.ps1'), '-Action', 'Create', '-Root', $flow, '-Work', (Join-Path $fakeProd 'cdu')) }
+        @{ Name = 'ime-reg（-Out 在生产根目录下）'; Args = @('-File', (Join-Path $items 'ime-reg.ps1'), '-Sdk', $work, '-Out', (Join-Path $fakeProd 'ime-reg')) }
+    )
+    foreach ($r in $runs) {
+        $out = Join-Output (& pwsh -NoProfile @($r.Args) 2>&1)
+        # 只认守卫自己的报错（「… 在生产根目录 … 下」），别的地方碰巧带「生产」两个字的不算
+        $want = if ($r.Name -like '*新建根目录*') { '不新建根目录' } else { '在生产根目录\s*.+下' }
+        Check ($LASTEXITCODE -ne 0 -and $out -match $want) "$($r.Name) 拿 $($r.Args[-1]) 要停（$want），退出码 $LASTEXITCODE：$($out.Substring(0, [Math]::Min(300, $out.Length)))"
+    }
+    Check (-not (Test-Path (Join-Path $work 'up')) -and -not (Test-Path (Join-Path $work 'cdu')) -and -not (Test-Path (Join-Path $work 'yys-out'))) '被拒时没建工作目录'
+    foreach ($d in 'up', 'ime', 'fetch', 'cdu', 'ime-reg') { Check (-not (Test-Path (Join-Path $fakeProd $d))) "被拒时没在生产根目录下建 $d" }
+
+    # ime-reg 绕过管理器用启动器开机：实例目录（ImeAvdHome）在生产根目录下就停，不建输出目录
+    $imeConfig = Join-Path $work 'ime.psd1'
+    Set-Content -LiteralPath $imeConfig -Encoding utf8 -Value "@{ ProductionRoots = @($(& $q $fakeProd)); ImeAvdHome = $(& $q (Join-Path $fakeProd 'avd')); Launcher = $(& $q (Join-Path $work 'missing\Launcher')) }"
+    $env:MODAVD_E2E_CONFIG = $imeConfig
+    $imeOut = Join-Path $work 'ime-reg-out'
+    $out = Join-Output (& pwsh -NoProfile -File (Join-Path $items 'ime-reg.ps1') -Sdk $work -Out $imeOut 2>&1)
+    $env:MODAVD_E2E_CONFIG = $config
+    Check ($LASTEXITCODE -ne 0 -and $out -match 'ImeAvdHome.*在生产根目录\s*.+下') "ime-reg 的 ImeAvdHome 在生产根目录下要停，退出码 $LASTEXITCODE：$($out.Substring(0, [Math]::Min(300, $out.Length)))"
+    Check (-not (Test-Path $imeOut)) 'ime-reg 被拒时没建输出目录'
+
+    # ---- game-real 绕过管理器用启动器开机：实例目录（GameAvdHome）在生产根目录下就停；GameAvds 的实例名要像个名字
+    # 仓库外的东西都指到不存在的路径，没有真程序可跑
+    $missing = Join-Path $work 'missing'
+    $quote = { param($s) "'" + ($s -replace "'", "''") + "'" }
+    $externals = (('Launcher', 'Monitor', 'VulkanFixLib', 'PackageScripts', 'Kit') | ForEach-Object { "$_ = $(& $quote (Join-Path $missing $_))" }) -join '; '
+    $gameRuns = @(
+        @{ Name = 'game-real（实例目录在生产根目录下）'; Home = (Join-Path $fakeProd 'avd'); Avds = "@{ r1999 = 'mas_1' }"; Want = '在生产根目录\s*.+下' }
+        @{ Name = 'game-real（GameAvds 的实例名带路径）'; Home = (Join-Path $work 'game-avd'); Avds = "@{ r1999 = '..\mas_1' }"; Want = 'GameAvds 里 r1999 的实例名不对' }
+    )
+    foreach ($g in $gameRuns) {
+        $gameConfig = Join-Path $work 'game.psd1'
+        Set-Content -LiteralPath $gameConfig -Encoding utf8 -Value "@{ ProductionRoots = @($(& $quote $fakeProd)); GameAvdHome = $(& $quote $g.Home); GameAvds = $($g.Avds); $externals }"
+        $env:MODAVD_E2E_CONFIG = $gameConfig
+        $gameOut = Join-Path $work 'game-out'
+        $out = Join-Output (& pwsh -NoProfile -File (Join-Path $items 'game-real.ps1') -Game r1999 -Sdk $missing -Out $gameOut 2>&1)
+        $env:MODAVD_E2E_CONFIG = $config
+        Check ($LASTEXITCODE -ne 0 -and $out -match $g.Want) "$($g.Name) 要停（$($g.Want)），退出码 $LASTEXITCODE：$($out.Substring(0, [Math]::Min(300, $out.Length)))"
+        Check (-not (Test-Path $gameOut)) "$($g.Name)：被拒时没建输出目录"
+    }
+    # 被拒的这一路上，（假的）生产根目录一个文件都没变
+    Check ((Snapshot $fakeProd) -eq $prodBefore) '生产根目录里的文件被动过了'
+    Write-Host "root guards: $script:count checks passed"
+} finally {
+    foreach ($k in $saved.Keys) { [Environment]::SetEnvironmentVariable($k, $saved[$k]) }
+    Remove-Item -LiteralPath $work -Recurse -Force -ErrorAction SilentlyContinue
+}
+# 上面调过故意失败的子进程；CI 的 pwsh 步骤会把最后的 $LASTEXITCODE 当成退出码
+exit 0
diff --git a/tests/root-sdk.ps1 b/tests/root-sdk.ps1
new file mode 100644
index 0000000..364deb7
--- /dev/null
+++ b/tests/root-sdk.ps1
@@ -0,0 +1,122 @@
+#requires -Version 7.0
+# Set-RootSdk（items\common.ps1）的静态测试：测试根临时指到被测 SDK、跑完换回，mas-avd.json 一个字节都不能多改。
+# testbed 的根是整包装出来的，mas-avd.json 里没有 sdkRoot；以前遇到这种根直接报错，bridge、bridge-default、datadisk、yys 都开不了。
+# 不开模拟器、不调 modavd：同步工具和 port_base 核对换成空函数，测试根全在临时目录里。
+# 跑法（Windows 和 Linux 都行）：pwsh -NoProfile -File tests/root-sdk.ps1
+$ErrorActionPreference = 'Stop'
+$repo = Split-Path $PSScriptRoot -Parent
+$scratch = Join-Path ([IO.Path]::GetTempPath()) "modavd-rootsdk-$([guid]::NewGuid().ToString('N'))"
+$failures = [Collections.Generic.List[string]]::new()
+$checks = 0
+function Check([bool]$ok, [string]$message) {
+    $script:checks++
+    if (-not $ok) { $script:failures.Add($message); Write-Host "FAIL $message" }
+}
+$savedConfig = $env:MODAVD_E2E_CONFIG
+try {
+    $null = New-Item -ItemType Directory -Force $scratch
+    $env:MODAVD_E2E_CONFIG = Join-Path $scratch 'empty.psd1'
+    Set-Content -LiteralPath $env:MODAVD_E2E_CONFIG -Value '@{}'
+    # common.ps1 只有函数定义和几个变量，dot-source 不跑别的
+    . (Join-Path $repo 'items\common.ps1')
+    $script:calls = [Collections.Generic.List[string]]::new()
+    function Sync-RootTools([string]$Root) { $script:calls.Add("sync $Root") }
+    function Assert-ManagerPortBase([string]$Root, [string]$Exe, [int]$Want = 0) { $script:calls.Add("portbase $Root"); 31000 }
+
+    $n = 0
+    function NewRoot([string]$Text) {
+        $script:n++
+        $r = Join-Path $scratch "root$script:n"
+        $null = New-Item -ItemType Directory -Force $r
+        [IO.File]::WriteAllText((Join-Path $r 'mas-avd.json'), $Text, [Text.UTF8Encoding]::new($false))
+        $r
+    }
+    function Json([string]$Root) { [IO.File]::ReadAllText((Join-Path $Root 'mas-avd.json')) }
+    # 管理器（Go 的 encoding/json）不认多余的逗号；ConvertFrom-Json 认，所以另用严格的 System.Text.Json 核
+    function Strict([string]$Root) {
+        try { [System.Text.Json.JsonDocument]::Parse((Json $Root)).Dispose(); $true } catch { $false }
+    }
+    $sdk = 'E:\aosp\sdk-mas39'
+
+    # ---- 1. testbed 的根：没有 sdkRoot（LF、两格缩进，和整包装出来的一样）
+    $plain = "{`n  `"portBase`": 31000,`n  `"adbServerPort`": 31099,`n  `"instances`": {`n    `"1`": {`n      `"initialized`": true`n    }`n  }`n}"
+    $r = NewRoot $plain
+    $script:calls.Clear()
+    $old = Set-RootSdk $r $sdk
+    Check ($null -eq $old) "root without sdkRoot must return `$null, got: [$old]"
+    $j = Json $r | ConvertFrom-Json
+    Check ($j.sdkRoot -ceq $sdk) "sdkRoot must be the SDK under test, got: $($j.sdkRoot)"
+    Check ($j.portBase -eq 31000 -and $j.adbServerPort -eq 31099 -and $j.instances.'1'.initialized) 'the other keys must stay'
+    Check (Strict $r) 'with sdkRoot inserted the file must be strict JSON'
+    Check ((Json $r) -ceq "{`n  `"sdkRoot`": `"E:\\aosp\\sdk-mas39`",$($plain.Substring(1))") "sdkRoot must be inserted as the first key with the file's own newline and indent, got: $(Json $r)"
+    Check (($script:calls -join ',') -ceq "sync $r,portbase $r") "Set-RootSdk must sync the tools and check port_base first, got: $($script:calls -join ',')"
+    Set-RootSdk $r $old | Out-Null
+    Check ((Json $r) -ceq $plain) "switching back must remove the inserted key byte for byte, got: $(Json $r)"
+
+    # CRLF
+    $crlf = $plain -replace "`n", "`r`n"
+    $r = NewRoot $crlf
+    $old = Set-RootSdk $r $sdk
+    Check ((Json $r).StartsWith("{`r`n  `"sdkRoot`": ")) 'CRLF file must get a CRLF line'
+    Set-RootSdk $r $old | Out-Null
+    Check ((Json $r) -ceq $crlf) 'CRLF root must come back byte for byte'
+
+    # 管理器中途改写过 mas-avd.json，sdkRoot 成了最后一个键：换回时连同前面的逗号一起删
+    $r = NewRoot $plain
+    $old = Set-RootSdk $r $sdk
+    $rewritten = "{`n  `"portBase`": 31000,`n  `"adbServerPort`": 31099,`n  `"instances`": {},`n  `"sdkRoot`": `"E:\\aosp\\sdk-mas39`"`n}"
+    [IO.File]::WriteAllText((Join-Path $r 'mas-avd.json'), $rewritten, [Text.UTF8Encoding]::new($false))
+    Set-RootSdk $r $old | Out-Null
+    Check ((Json $r) -ceq "{`n  `"portBase`": 31000,`n  `"adbServerPort`": 31099,`n  `"instances`": {}`n}") "sdkRoot as the last key must be removed with the comma before it, got: $(Json $r)"
+    Check (Strict $r) 'after removing the last key the file must be strict JSON'
+
+    # 一行的、空对象的
+    $r = NewRoot '{"portBase":31000}'
+    $old = Set-RootSdk $r $sdk
+    Check ((Json $r) -ceq '{"sdkRoot": "E:\\aosp\\sdk-mas39", "portBase":31000}') "one-line JSON must get sdkRoot first, got: $(Json $r)"
+    Check (Strict $r) 'one-line JSON with sdkRoot must be strict JSON'
+    Set-RootSdk $r $old | Out-Null
+    Check ((Json $r) -ceq '{"portBase":31000}') "one-line JSON must come back byte for byte, got: $(Json $r)"
+    $r = NewRoot '{}'
+    $old = Set-RootSdk $r $sdk
+    Check ((Json $r) -ceq '{"sdkRoot": "E:\\aosp\\sdk-mas39"}') "empty object must get sdkRoot without a trailing comma, got: $(Json $r)"
+    Check (Strict $r) 'empty object with sdkRoot must be strict JSON'
+    Set-RootSdk $r $old | Out-Null
+    Check ((Json $r) -ceq '{}') "empty object must come back as {}, got: $(Json $r)"
+
+    # 没有这个键时传 $null：什么都不改
+    $r = NewRoot $plain
+    Set-RootSdk $r $null | Out-Null
+    Check ((Json $r) -ceq $plain) 'restoring $null on a root without sdkRoot must not touch it'
+
+    # ---- 2. 原来就有 sdkRoot 的根（以前的 rel36 那种）：只换值，返回原值，换回后一字不差
+    $dev = "{`n  `"sdkRoot`": `"E:\\aosp\\sdk-mas36`",`n  `"portBase`": 31000`n}"
+    $r = NewRoot $dev
+    $old = Set-RootSdk $r $sdk
+    Check ($old -ceq 'E:\aosp\sdk-mas36') "existing sdkRoot must be returned unescaped, got: [$old]"
+    Check ((Json $r | ConvertFrom-Json).sdkRoot -ceq $sdk) 'existing sdkRoot must be replaced'
+    Set-RootSdk $r $old | Out-Null
+    Check ((Json $r) -ceq $dev) "existing sdkRoot must come back byte for byte, got: $(Json $r)"
+
+    # 原来是 ""（管理器当成没设）：换回 ""，不删键
+    $blank = "{`n  `"portBase`": 31000,`n  `"sdkRoot`": `"`"`n}"
+    $r = NewRoot $blank
+    $old = Set-RootSdk $r $sdk
+    Check ($old -ceq '') "blank sdkRoot must return '', got: [$old]"
+    Set-RootSdk $r $old | Out-Null
+    Check ((Json $r) -ceq $blank) "blank sdkRoot must come back as blank, got: $(Json $r)"
+
+    # ---- 3. 用到 Set-RootSdk 的项都把原值原样传回去（不能先转成 [string]，那样 $null 会变成 ""，加的键就删不掉了）
+    foreach ($item in 'bridge', 'bridge-default', 'datadisk', 'yys') {
+        $itemText = Get-Content -LiteralPath (Join-Path $repo "items\$item.ps1") -Raw
+        Check ($itemText -match '\$old = Set-RootSdk \$Root \$Sdk') "$item.ps1 must keep what Set-RootSdk returns"
+        Check ($itemText -match 'Set-RootSdk \$Root \$old') "$item.ps1 must switch back with that value"
+        Check ($itemText -notmatch '\[string\]\$old') "$item.ps1 must not turn the returned value into a string"
+    }
+} finally {
+    $env:MODAVD_E2E_CONFIG = $savedConfig
+    Remove-Item -LiteralPath $scratch -Recurse -Force -ErrorAction SilentlyContinue
+}
+if ($failures.Count) { Write-Host "$($failures.Count) of $checks checks failed"; exit 1 }
+Write-Host "root-sdk: all $checks checks passed"
+exit 0
diff --git a/tests/tooling-guards.ps1 b/tests/tooling-guards.ps1
new file mode 100644
index 0000000..b16e237
--- /dev/null
+++ b/tests/tooling-guards.ps1
@@ -0,0 +1,186 @@
+#requires -Version 7.0
+# 管理器必须明确给、port_base 核对、游戏端口守卫的静态测试：不开模拟器、不连 adb、不调真的 modavd.exe。
+# 跑法（Windows 和 Linux 都行）：pwsh -NoProfile -File tests/tooling-guards.ps1
+$ErrorActionPreference = 'Stop'
+$repo = Split-Path $PSScriptRoot -Parent
+$scratch = Join-Path ([IO.Path]::GetTempPath()) "modavd-guards-$([guid]::NewGuid().ToString('N'))"
+$failures = [Collections.Generic.List[string]]::new()
+$checks = 0
+function Check([bool]$ok, [string]$message) {
+    $script:checks++
+    if (-not $ok) { $script:failures.Add($message); Write-Host "FAIL $message" }
+}
+# 这个脚本里 dot-source 的东西只有 common.ps1 / port-guard.ps1（只有函数定义，不跑整段）
+function Throws([scriptblock]$Body) {
+    try { & $Body | Out-Null } catch { return "$($_.Exception.Message)" }
+    return $null
+}
+$saved = @{}
+foreach ($key in 'MODAVD_E2E_CONFIG', 'MODAVD_REGRESS_MANAGER', 'MODAVD_REGRESS_PACKAGE') { $saved[$key] = [Environment]::GetEnvironmentVariable($key) }
+try {
+    $null = New-Item -ItemType Directory -Force $scratch
+    $mgrFixture = Join-Path $scratch 'manager'
+    $null = New-Item -ItemType Directory -Force $mgrFixture
+    $empty = Join-Path $scratch 'empty.psd1'
+    Set-Content -LiteralPath $empty -Value '@{}'
+    # 本机配置里有 Manager 键也不能被取用
+    $withManager = Join-Path $scratch 'with-manager.psd1'
+    Set-Content -LiteralPath $withManager -Value "@{ Manager = '$($mgrFixture.Replace("'", "''"))' }"
+
+    # ---- 1. regress.ps1 不给 -Manager 就报错（环境变量和本机配置里有也不行）
+    $env:MODAVD_E2E_CONFIG = $withManager
+    $env:MODAVD_REGRESS_MANAGER = $mgrFixture
+    $pwsh = (Get-Process -Id $PID).Path
+    $out = & $pwsh -NoProfile -File (Join-Path $repo 'regress.ps1') -Suite (Join-Path $scratch 'no-suite.psd1') -Sdk $scratch 2>&1 | ForEach-Object { "$_" }
+    Check ($LASTEXITCODE -ne 0) 'regress.ps1 without -Manager must fail'
+    Check (($out -join "`n") -match '没给 -Manager') "regress.ps1 without -Manager must say so, got: $($out -join ' | ')"
+
+    # ---- 2. common.ps1：没有 MODAVD_REGRESS_MANAGER 就报错；本机配置的 Manager 不算
+    $env:MODAVD_E2E_CONFIG = $withManager
+    $env:MODAVD_REGRESS_MANAGER = ''
+    $env:MODAVD_REGRESS_PACKAGE = ''
+    . (Join-Path $repo 'items\common.ps1')
+    $m = Throws { Get-ManagerDir }
+    Check ($m -and $m -match 'MODAVD_REGRESS_MANAGER') "Get-ManagerDir must fail without MODAVD_REGRESS_MANAGER, got: $m"
+    $script:ManagerDir = $mgrFixture
+    Check ((Get-ManagerDir) -eq $mgrFixture) 'Get-ManagerDir returns the manager that was given'
+
+    # ---- 3. Assert-ManagerPortBase：取 JSON 的一步换成假的，不调真的 modavd
+    $fx = @{ List = $null; Version = '0.3.0' }
+    function Invoke-ModavdJson([string]$Root, [string]$Exe, [string[]]$Argv) {
+        if ($Argv[0] -eq 'list') { return $fx.List }
+        if ($Argv[0] -eq 'version') { return [pscustomobject]@{ version = $fx.Version } }
+        throw "unexpected modavd call $($Argv -join ' ')"
+    }
+    function NewRoot([string]$name, $portBase) {
+        $r = Join-Path $scratch $name
+        $null = New-Item -ItemType Directory -Force $r
+        $j = if ($null -ne $portBase) { @{ adbServerPort = 23083; portBase = $portBase } } else { @{ adbServerPort = 23083 } }
+        $j | ConvertTo-Json | Set-Content -LiteralPath (Join-Path $r 'mas-avd.json')
+        $r
+    }
+    $fakeExe = Join-Path $mgrFixture 'tools/modavd.exe'
+
+    # 没有 port_base（旧版）
+    $fx.List = [pscustomobject]@{ root = 'x'; instances = @() }
+    $m = Throws { Assert-ManagerPortBase (NewRoot 'r1' 23000) $fakeExe }
+    Check ($m -and $m -match '不认 portBase' -and $m.Contains($fakeExe) -and $m.Contains('0.3.0')) "old manager without port_base must be refused with path and version, got: $m"
+    # 和 mas-avd.json 的 portBase 不一致
+    $fx.List = [pscustomobject]@{ port_base = 24000; instances = @() }
+    $m = Throws { Assert-ManagerPortBase (NewRoot 'r2' 23000) $fakeExe }
+    Check ($m -and $m -match '23000' -and $m -match '24000') "port_base different from portBase must be refused, got: $m"
+    # 是 20000（根目录没写 portBase；写了 20000 也一样）
+    $fx.List = [pscustomobject]@{ port_base = 20000; instances = @() }
+    $m = Throws { Assert-ManagerPortBase (NewRoot 'r3' $null) $fakeExe }
+    Check ($m -and $m -match '20000') "port_base 20000 must be refused, got: $m"
+    $m = Throws { Assert-ManagerPortBase (NewRoot 'r3b' 20000) $fakeExe }
+    Check ($m -and $m -match '20000') "port_base 20000 with portBase 20000 must be refused, got: $m"
+    # 正常
+    $fx.List = [pscustomobject]@{ port_base = 23000; instances = @() }
+    $v = $null
+    $m = Throws { $script:v = Assert-ManagerPortBase (NewRoot 'r4' 23000) $fakeExe }
+    Check (-not $m -and $script:v -eq 23000) "matching port_base must pass and return 23000, got: $m / $($script:v)"
+    $m = Throws { Assert-ManagerPortBase (NewRoot 'r5' $null) $fakeExe }
+    Check (-not $m) "port_base 23000 with no portBase written must pass, got: $m"
+    # Resolve-PortBase 走同一道核对（要求的 portBase 和实际不同也报错）
+    $m = Throws { Resolve-PortBase (NewRoot 'r6' $null) $fakeExe 24000 }
+    Check ($m -and $m -match '24000') "Resolve-PortBase must refuse a different wanted portBase, got: $m"
+    $fx.List = [pscustomobject]@{ instances = @() }
+    $m = Throws { Resolve-PortBase (NewRoot 'r7' 23000) $fakeExe 23000 }
+    Check ($m -and $m -match 'port_base') "Resolve-PortBase must refuse a manager without port_base, got: $m"
+
+    # ---- 4. 调用点：开测试根实例之前真的会核对（静态看函数体）
+    $tokens = $null; $errs = $null
+    $ast = [System.Management.Automation.Language.Parser]::ParseFile((Join-Path $repo 'items\common.ps1'), [ref]$tokens, [ref]$errs)
+    $fnBody = { param($name) ($ast.FindAll({ param($n) $n -is [System.Management.Automation.Language.FunctionDefinitionAst] -and $n.Name -eq $name }, $true) | Select-Object -First 1).Body.Extent.Text }
+    Check ((& $fnBody 'Set-RootSdk') -match 'Assert-ManagerPortBase') 'Set-RootSdk must check port_base before touching the test root'
+    Check ((& $fnBody 'Resolve-PortBase') -match 'Assert-ManagerPortBase') 'Resolve-PortBase must use Assert-ManagerPortBase'
+    Check ((& $fnBody 'Sync-RootTools') -match 'Get-ManagerDir') 'Sync-RootTools must require the manager'
+
+    # ---- 5. 游戏端口守卫
+    # 19998、5035 只有 +2（gRPC）会碰到
+    foreach ($bad in 20000, 20040, 20047, 20049, 20050, 19999, 19998, 5037, 5036, 5035, 20048) {
+        $m = Throws { Assert-GameConsolePort $bad 'sr' }
+        Check ($null -ne $m) "game console port $bad must be refused"
+    }
+    foreach ($good in 20120, 20072, 20100, 20096, 20051) {
+        $m = Throws { Assert-GameConsolePort $good 'sr' }
+        Check ($null -eq $m) "game console port $good must pass, got: $m"
+    }
+    # game-real.ps1：默认端口不在生产段，真的调了守卫，认 GamePorts
+    $game = Get-Content -LiteralPath (Join-Path $repo 'items\game-real.ps1') -Raw
+    Check ($game -notmatch 'Port\s*=\s*200[0-4]\d\b') 'game-real.ps1 must not hard-code a port in 20000-20049'
+    Check ($game -match "sr\s*=\s*@\{[^}]*Port\s*=\s*20120\b") 'game-real.ps1 sr port must be 20120'
+    Check ($game -match '\(-not \$ReJudge\) \{\s+Assert-GameConsolePort \$cfg\.Port') 'game-real.ps1 must call Assert-GameConsolePort on the console port (unless -ReJudge)'
+    Check ($game -match 'Use-Local GamePorts \$null' -and $game -match '\$gamePorts\.Contains\(\$Game\)') 'game-real.ps1 must read GamePorts'
+    Check ($game -match 'Use-Local GameAvds \$null' -and $game -match '\$gameAvds\.Contains\(\$Game\)') 'game-real.ps1 must read GameAvds'
+
+    # ---- 6. 已有测试根里新建实例前的端口检查：测试根自己的 adb server 开着不算（11-06 实跑：upgrade 之后 ime-pkg 被它拦住）
+    $rootAdb = Join-Path $scratch 'root/sdk/platform-tools/adb.exe'
+    $otherAdb = Join-Path $scratch 'other/sdk/platform-tools/adb.exe'
+    function L([int]$port, $path) { [pscustomobject]@{ LocalPort = $port; Path = $path } }
+    $inst = @(31090, 31091, 31092); $adbs = @(31099, 31098)
+    $r = @(Get-PortConflicts @() $inst $adbs $rootAdb)
+    Check ($r.Count -eq 0) "nothing listening must give no conflicts, got: $($r -join ',')"
+    $r = @(Get-PortConflicts @((L 31099 $rootAdb), (L 31098 $rootAdb.ToUpper())) $inst $adbs $rootAdb)
+    Check ($r.Count -eq 0) "the test root's own adb server on its adb ports must not count, got: $($r -join ',')"
+    $r = @(Get-PortConflicts @((L 31099 (Join-Path $scratch 'root/sdk/../sdk/platform-tools/adb.exe'))) $inst $adbs $rootAdb)
+    Check ($r.Count -eq 0) "own adb given as a non-normalized path must not count, got: $($r -join ',')"
+    $r = @(Get-PortConflicts @((L 31099 $otherAdb)) $inst $adbs $rootAdb)
+    Check ($r.Count -eq 1 -and $r[0] -eq 31099) "another root's adb on the adb port must count, got: $($r -join ',')"
+    $r = @(Get-PortConflicts @((L 31098 $null)) $inst $adbs $rootAdb)
+    Check ($r.Count -eq 1 -and $r[0] -eq 31098) "an adb port held by a process whose path is unknown must count, got: $($r -join ',')"
+    $r = @(Get-PortConflicts @((L 31091 $rootAdb), (L 31090 $null), (L 31091 $null)) $inst $adbs $rootAdb)
+    Check ($r.Count -eq 2 -and $r[0] -eq 31090 -and $r[1] -eq 31091) "instance ports must count whoever holds them (sorted, unique), got: $($r -join ',')"
+    $r = @(Get-PortConflicts @((L 31093 $null), (L 31097 $otherAdb)) $inst $adbs $rootAdb)
+    Check ($r.Count -eq 0) "ports outside the instance and adb ports must not count, got: $($r -join ',')"
+    $ime = Get-Content -LiteralPath (Join-Path $repo 'items\ime-pkg.ps1') -Raw
+    Check ($ime -match 'Get-PortConflicts \$listeners \$mine @\(\$AdbPort, \$ScriptAdbPort\) \$adbExe') 'ime-pkg.ps1 must check ports with Get-PortConflicts and the root''s own adb'
+    Check ($ime -match "\`$adbExe = Join-Path \`$Root 'sdk\\platform-tools\\adb\.exe'") 'ime-pkg.ps1 adbExe must be the test root''s own adb'
+
+    # ---- 7. regress.ps1 开跑前的核对（静态看：真跑要一个管理器目录，这里不造假 exe）
+    $reg = Get-Content -LiteralPath (Join-Path $repo 'regress.ps1') -Raw
+    $outCheck = $reg.IndexOf("Assert-NotProduction `$Out '回归输出'")
+    $outMake = $reg.IndexOf('New-Item -ItemType Directory -Force $Out')
+    Check ($outCheck -gt 0 -and $outMake -gt $outCheck) 'regress.ps1 must refuse -Out under a production root before creating it'
+    Check ($reg -match "foreach \(\`$key in 'TestRoot', 'PackageRoot'\) \{\s+\`$configured = Use-Local \`$key \`$null '' -Optional\s+if \(\`$configured\) \{ Assert-NotProduction \`$configured `"本机配置的 \`$key`"; Assert-ListedTestRoot \`$configured") 'regress.ps1 must check the configured TestRoot / PackageRoot (production and TestRoots) before running'
+    Check ($reg -match "foreach \(\`$key in 'GameAvdHome', 'SrAvdHome', 'ImeAvdHome'\) \{\s+\`$configured = Use-Local \`$key \`$null '' -Optional\s+if \(\`$configured\) \{ Assert-NotProduction \`$configured") 'regress.ps1 must check GameAvdHome / SrAvdHome / ImeAvdHome before running'
+    $configCheck = $reg.IndexOf("foreach (`$key in 'GameAvdHome'")
+    $firstItem = $reg.IndexOf('Start-Process pwsh')
+    Check ($configCheck -gt 0 -and $firstItem -gt $configCheck) 'regress.ps1 must check the configuration before it starts any item'
+
+    # ---- 8. 两条语句并成一行（11-06 审查：created-disk-usage 的 `Save-State    Run-Modavd @(...)` 让 create 根本没跑——
+    # PowerShell 把后一条当成前一个函数的参数）。脚本里自己的函数后面跟着另一个函数名当裸参数、或 `}$x = …`，就算并行了
+    $shared = foreach ($lib in 'items\common.ps1', 'items\port-guard.ps1', 'items\disk-usage-lib.ps1', 'local.ps1') {
+        $libAst = [System.Management.Automation.Language.Parser]::ParseFile((Join-Path $repo $lib), [ref]$null, [ref]$null)
+        $libAst.FindAll({ param($n) $n -is [System.Management.Automation.Language.FunctionDefinitionAst] }, $true) | ForEach-Object { $_.Name }
+    }
+    $merged = [Collections.Generic.List[string]]::new()
+    foreach ($f in @(Get-ChildItem -LiteralPath (Join-Path $repo 'items') -Filter '*.ps1') + @(Get-Item -LiteralPath (Join-Path $repo 'regress.ps1'))) {
+        $fileAst = [System.Management.Automation.Language.Parser]::ParseFile($f.FullName, [ref]$null, [ref]$null)
+        # 调用按 PowerShell 的规矩不分大小写；裸参数要和函数名逐字相同才算（`A emu ime status` 里的 status 是控制台命令，不是 Status）
+        $names = [Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
+        $exact = [Collections.Generic.HashSet[string]]::new([StringComparer]::Ordinal)
+        foreach ($n in @($shared) + @($fileAst.FindAll({ param($n) $n -is [System.Management.Automation.Language.FunctionDefinitionAst] }, $true) | ForEach-Object { $_.Name })) { [void]$names.Add($n); [void]$exact.Add($n) }
+        foreach ($c in $fileAst.FindAll({ param($n) $n -is [System.Management.Automation.Language.CommandAst] }, $true)) {
+            $cmd = $c.GetCommandName()
+            if (-not $cmd -or -not $names.Contains($cmd)) { continue }
+            foreach ($el in @($c.CommandElements | Select-Object -Skip 1)) {
+                if ($el -is [System.Management.Automation.Language.StringConstantExpressionAst] -and $el.StringConstantType -eq 'BareWord' -and $exact.Contains($el.Value)) {
+                    $merged.Add("$($f.Name):$($c.Extent.StartLineNumber) $($c.Extent.Text)")
+                }
+            }
+        }
+        $lineNo = 0
+        foreach ($line in [IO.File]::ReadAllLines($f.FullName)) { $lineNo++; if ($line -match '^\s*\}\s*\$\w+\s*=') { $merged.Add("$($f.Name):$lineNo $line") } }
+    }
+    Check ($merged.Count -eq 0) "two statements run together on one line: $($merged -join ' | ')"
+}
+finally {
+    foreach ($key in $saved.Keys) { [Environment]::SetEnvironmentVariable($key, $saved[$key]) }
+    if (Test-Path -LiteralPath $scratch) { Remove-Item -LiteralPath $scratch -Recurse -Force }
+}
+if ($failures.Count) { Write-Host "$($failures.Count) of $checks checks failed"; exit 1 }
+Write-Host "tooling guards: $checks checks passed"
+# 上面调过故意失败的子进程；CI 的 pwsh 步骤会把最后的 $LASTEXITCODE 当成退出码
+exit 0
diff --git a/tests/upgrade-version.ps1 b/tests/upgrade-version.ps1
index c74dea3..da84e95 100644
--- a/tests/upgrade-version.ps1
+++ b/tests/upgrade-version.ps1
@@ -71,7 +71,9 @@ try {
         $prev = Join-Path $base 'previous package'
         $next = Join-Path $base 'next package'
         $work = Join-Path $base 'work'
-        $official = Join-Path $base 'official sdk'
+        # 已有的测试根（11-05 起升级测试不新建根目录，在已有的根上装回上一版再升级）
+        $testRoot = Join-Path $base 'test root'
+        Put (Join-Path $testRoot 'mas-avd.json') '{"portBase": 23000, "adbServerPort": 23099, "scriptAdbServerPort": 23098, "instances": {}}'
         $oldId = if ($case.OldId) { $case.OldId } else { 'mas-37' }
         foreach ($pkg in $prev, $next) {
             Put (Join-Path $pkg 'sdk\emulator\emulator.exe') 'fixture'
@@ -85,7 +87,7 @@ try {
         if ($case.PackageAlsoSdk) { Put (Join-Path $next 'emulator\emulator.exe') 'fixture' }
         $env:MODAVD_REGRESS_PACKAGE = Join-Path $next 'tools'
         $fixture = @{ Script = ''; Tag = ''; Starts = 0; Stops = 0 }
-        foreach ($exe in (Join-Path $work 'cli\modavd.exe'), (Join-Path $work 'root\tools\modavd.exe')) {
+        foreach ($exe in (Join-Path $work 'cli\modavd.exe'), (Join-Path $testRoot 'tools\modavd.exe')) {
             MockCommand $exe {
                 $global:LASTEXITCODE = 0
                 if ($args[2] -eq '--json') {
@@ -96,9 +98,7 @@ try {
                 if ($args[2] -eq 'stop') { $fixture.Stops++ }
             }
         }
-        $null = New-Item -ItemType Directory -Force (Join-Path $official 'system-images')
-        Put (Join-Path $official 'platform-tools\adb.exe') 'fixture'
-        foreach ($exe in (Join-Path $official 'platform-tools\adb.exe'), (Join-Path $work 'root\sdk\platform-tools\adb.exe')) {
+        foreach ($exe in @(Join-Path $testRoot 'sdk\platform-tools\adb.exe')) {
             MockCommand $exe {
                 $global:LASTEXITCODE = 0
                 if ($args -contains 'push') {
@@ -115,7 +115,7 @@ try {
         function global:Get-CimInstance { @() }
         $nextArg = if ($case.Sdk) { Join-Path $next 'sdk' } else { $next }
         if ($case.Sdk) { Manifest $nextArg $case.New $case.NewRaw }
-        $output = @(& $item -Prev $prev -Next $nextArg -ModavdOut $next -Work $work -Official $official -Keep)
+        $output = @(& $item -Prev $prev -Next $nextArg -ModavdOut $next -Root $testRoot -Work $work -Index 4 -Keep)
         $rows = @($output | Where-Object { $_ -like 'REGRESS-RESULT *' })
         Check ($rows.Count -eq 1) "$($case.Name): one result"
         $result = $rows[-1].Substring('REGRESS-RESULT '.Length) | ConvertFrom-Json