From 1e847f29035acd2465a121046a1d4c389d289382 Mon Sep 17 00:00:00 2001
From: qiyinxi <qiyinxi@foxmail.com>
Date: Sat, 7 Nov 2026 18:35:31 +0100
Subject: [PATCH 1/2] =?UTF-8?q?=E5=AE=A2=E4=BD=93=E9=A9=B1=E5=8A=A8?=
 =?UTF-8?q?=E5=BA=93=E8=A1=A5=E4=B8=81=EF=BC=9A=E4=BF=AE=E6=89=B9=E9=87=8F?=
 =?UTF-8?q?=E6=8F=8F=E8=BF=B0=E7=AC=A6=E6=9B=B4=E6=96=B0=E9=87=8C=E6=A8=A1?=
 =?UTF-8?q?=E6=9D=BF=E8=B7=A8=E7=BB=91=E5=AE=9A=E5=86=99=E9=94=99=E6=A0=BC?=
 =?UTF-8?q?=E5=AD=90?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

镜像自带的 libvulkan_enc.so 里，doEmulatedDescriptorBufferInfoWriteFromTemplate 和
doEmulatedDescriptorBufferViewWriteFromTemplate 跨到下一个绑定以后，用
table[currBinding][dstArrayElement + i] 写，应为回卷后的 arrOffset（同文件写图像的那个函数是对的）。
一个模板条目连写几个相邻绑定时（World of Airports 的 Unity GPU 蒙皮：descriptorCount=4 写第 0–3 号），
后面几个绑定没写上、反而越界写，计算着色器拿着没写过的存储缓冲描述符派发，宿主显卡卡死，
模拟器报 VK_ERROR_DEVICE_LOST 退出。只在 VulkanBatchedDescriptorSetUpdate 开着时走这条路。

vkfix 加第 5 步，两处等长替换（0x1FED62 14 字节、0x1FEE2C 4 字节），下标改为「下一个 arrOffset
减一」。补丁库 sha256 9e5ba745…；宿主缓存名换成 libvulkan_enc.khrfix-bindlock2-dstpl1.so，
不和 AUTO-MAS 那份（d5258af6…，没有这处修复）互相覆盖。

测试：unicorn 实跑两个函数（原版跨绑定写错、越界；改后 4 种写法全对）；单测核补丁点字节、
长度、范围和不重叠，真库比对 AUTO-MAS 那份加上两处补丁点；实机在 flow-b 开着批量更新进
因斯布鲁克，修复前 4 次 4 退，修复后不退。

Refs ModAVD/ModAVD#131
---
 internal/emu/vulkanfix.go      |  2 +-
 internal/emu/vulkanfix_test.go |  2 +-
 internal/vkfix/vkfix.go        | 40 +++++++++++++++++----
 internal/vkfix/vkfix_test.go   | 63 +++++++++++++++++++++++++++++++++-
 4 files changed, 98 insertions(+), 9 deletions(-)

diff --git a/internal/emu/vulkanfix.go b/internal/emu/vulkanfix.go
index 9fb954f..2de1fa5 100644
--- a/internal/emu/vulkanfix.go
+++ b/internal/emu/vulkanfix.go
@@ -441,7 +441,7 @@ func vulkanFixStatus(status string) (kind, rest string) {
 	return "", ""
 }
 
-// patchedVulkanLibrary is the host cache <root>\guest-patches\libvulkan_enc.khrfix-bindlock2.so, made when missing or
+// patchedVulkanLibrary is the host cache <root>\guest-patches\<vkfix.CacheName>, made when missing or
 // bad: pull the guest's own library, check its hash, patch, check the result's hash (vkfix.Patch), write it. ""
 // when any step fails (logged, nothing mounted). Host I/O errors (disk full, a virus scanner holding the file) are
 // warnings too.
diff --git a/internal/emu/vulkanfix_test.go b/internal/emu/vulkanfix_test.go
index b2f72c1..13e4b94 100644
--- a/internal/emu/vulkanfix_test.go
+++ b/internal/emu/vulkanfix_test.go
@@ -419,7 +419,7 @@ func TestMountVulkanFix(t *testing.T) {
 func TestVulkanFixConstants(t *testing.T) {
 	// what vulkanfix.sh is called with and what it expects (u= in the script)
 	if vkfix.UploadPath != "/data/local/tmp/vulkanfix-upload.so" || vkfix.GuestPath != "/vendor/lib64/libvulkan_enc.so" ||
-		vkfix.CacheName != "libvulkan_enc.khrfix-bindlock2.so" {
+		vkfix.CacheName != "libvulkan_enc.khrfix-bindlock2-dstpl1.so" {
 		t.Error("vkfix constants changed")
 	}
 }
diff --git a/internal/vkfix/vkfix.go b/internal/vkfix/vkfix.go
index 2dba70f..3eaefac 100644
--- a/internal/vkfix/vkfix.go
+++ b/internal/vkfix/vkfix.go
@@ -1,7 +1,7 @@
-// Package vkfix builds the patched guest Vulkan encoder (bindlock2, includes khrfix) from the image's own
-// /vendor/lib64/libvulkan_enc.so on the user's machine; the patched file is never distributed.
+// Package vkfix builds the patched guest Vulkan encoder (bindlock2, includes khrfix, plus the template rollover fix)
+// from the image's own /vendor/lib64/libvulkan_enc.so on the user's machine; the patched file is never distributed.
 //
-// Byte-for-byte port of the companion Vulkan fix implementation: khrfix jumps for
+// Steps 1 and 2 are a byte-for-byte port of the companion Vulkan fix implementation: khrfix jumps for
 // vkUpdateDescriptorSetWithTemplateKHR, and lock wrappers around
 // ResourceTracker::on_vkBindImageMemory(2) placed in the freed dynCheck function body.
 //
@@ -15,6 +15,12 @@
 //     drop the lock and, on the marker, call the encoder with the original exit's arguments. The lock is never held
 //     across a host round trip (version 1 did, and deadlocked against VulkanQueueSubmitWithCommands' global sequence
 //     number in 3 of 10 cold boots).
+//  3. template rollover (11-07, World of Airports device lost; not in the companion implementation): with batched
+//     descriptor set updates, doEmulatedDescriptor{BufferInfo,BufferView}WriteFromTemplate index the table with
+//     dstArrayElement + i after rolling over into the next binding, instead of the rolled-over arrOffset. An entry
+//     spanning bindings leaves them unwritten and writes past their arrays (the ImageInfo variant is right); a
+//     compute dispatch then uses never-written storage buffer descriptors and the host GPU hangs (VK_ERROR_DEVICE_LOST).
+//     Two same-length edits make both use the register that holds the next arrOffset, minus one.
 package vkfix
 
 import (
@@ -31,14 +37,29 @@ import (
 const (
 	// The image's library (API 34 google_apis x86_64) and the patched one.
 	OrigSHA256 = "898c0bbc38077e4b19d112f6c66e2970f1e015fc440fae091974b8f06e40fefb"
-	FixSHA256  = "d5258af6244679fd5ce50245b7dcc1f645d971a04f7e64fc9872fcfb9faa7ecb"
+	FixSHA256  = "9e5ba7452b7d834da575704b19bfa36bb2a4cf4e302fca8737629841e3ae736a"
 	// Where the guest library lives, and the upload path vulkanfix.sh expects (u= in the script).
 	GuestPath  = "/vendor/lib64/libvulkan_enc.so"
 	UploadPath = "/data/local/tmp/vulkanfix-upload.so"
-	// File name of the cached patched library in <root>\guest-patches.
-	CacheName = "libvulkan_enc.khrfix-bindlock2.so"
+	// File name of the cached patched library in <root>\guest-patches. Not the companion's khrfix-bindlock2 name: its
+	// library (sha256 d5258af6…) lacks the template rollover fix, and the two would overwrite each other's cache.
+	CacheName = "libvulkan_enc.khrfix-bindlock2-dstpl1.so"
 )
 
+// templateSites are the template rollover fix (3. above). In both loops the register written by the rollover cmov
+// holds the next arrOffset (1 after a rollover), so it minus one is the element to write.
+var templateSites = []struct {
+	va        int
+	orig, fix []byte
+	name      string
+}{
+	// lea rsi,[r13*2+0]; add rsi,r13; mov r14d,edx  ->  lea rsi,[r13+r13*2]; lea r14d,[rbx-1]; nopw 0(rax,rax)
+	{0x1FED62, mustHex("4a8d346d00000000 4c01ee 4189d6"), mustHex("4b8d746d00 448d73ff 0f1f440000"),
+		"doEmulatedDescriptorBufferInfoWriteFromTemplate"},
+	// lea r14d,[rcx+r10]  ->  lea r14d,[rdx-1]
+	{0x1FEE2C, mustHex("468d3411"), mustHex("448d72ff"), "doEmulatedDescriptorBufferViewWriteFromTemplate"},
+}
+
 // Virtual addresses, from bindlock.py (see the meaning there).
 const (
 	textDelta = 0x1000 // .text: vaddr 0x1fcee0, file offset 0x1fbee0
@@ -259,6 +280,13 @@ func Patch(original []byte) ([]byte, error) {
 		}
 	}
 
+	// 5. the template rollover fix
+	for _, s := range templateSites {
+		if err := put(s.va, s.fix, s.orig, s.name); err != nil {
+			return nil, err
+		}
+	}
+
 	if digest := SHA256Hex(data); digest != FixSHA256 {
 		return nil, errs.Newf(errs.Unsupported, "改完的库 sha256 %s 不是预期值", digest)
 	}
diff --git a/internal/vkfix/vkfix_test.go b/internal/vkfix/vkfix_test.go
index ff4f450..6e43e03 100644
--- a/internal/vkfix/vkfix_test.go
+++ b/internal/vkfix/vkfix_test.go
@@ -29,8 +29,56 @@ const (
 	goldenJmpKhr    = "e9ebe9ffff"
 	goldenJmpDyn    = "e9cb200200"
 	goldenExitMagic = "b83253414d5b415c415d415e415f5dc3"
+
+	// the companion's khrfix + bindlock2 library (no template rollover fix)
+	companionFixSHA256 = "d5258af6244679fd5ce50245b7dcc1f645d971a04f7e64fc9872fcfb9faa7ecb"
 )
 
+// The template rollover sites (checked by running both functions under unicorn, original and patched, 11-07):
+// same length as the original, inside .text, not overlapping each other or any other patched range.
+func TestTemplateSites(t *testing.T) {
+	golden := map[int][2]string{
+		0x1FED62: {"4a8d346d000000004c01ee4189d6", "4b8d746d00448d73ff0f1f440000"},
+		0x1FEE2C: {"468d3411", "448d72ff"},
+	}
+	if len(templateSites) != len(golden) {
+		t.Fatalf("%d template sites, want %d", len(templateSites), len(golden))
+	}
+	others := [][2]int{
+		{khrEntry, khrEntry + 5}, {khrDyn, khrDynEnd}, {exitBind, exitBind + len(exitBindOrig)},
+		{exitBind2, exitBind2 + len(exitBind2Orig)}, {fwdBind, fwdBind + 5}, {fwdBind2, fwdBind2 + 5},
+		{fwdBind2KHR, fwdBind2KHR + 5},
+	}
+	for _, s := range templateSites {
+		g, ok := golden[s.va]
+		if !ok {
+			t.Errorf("%s: unexpected site 0x%x", s.name, s.va)
+			continue
+		}
+		if hex.EncodeToString(s.orig) != g[0] || hex.EncodeToString(s.fix) != g[1] {
+			t.Errorf("%s (0x%x): %x -> %x, want %s -> %s", s.name, s.va, s.orig, s.fix, g[0], g[1])
+		}
+		if len(s.orig) != len(s.fix) {
+			t.Errorf("%s: %d bytes replaced by %d", s.name, len(s.orig), len(s.fix))
+		}
+		if s.va < 0x1fcee0 || s.va+len(s.fix) > 0x1fcee0+0x1e951b {
+			t.Errorf("%s: 0x%x outside .text", s.name, s.va)
+		}
+		for _, o := range append(others, func() (r [][2]int) {
+			for _, u := range templateSites {
+				if u.va != s.va {
+					r = append(r, [2]int{u.va, u.va + len(u.fix)})
+				}
+			}
+			return
+		}()...) {
+			if s.va < o[1] && o[0] < s.va+len(s.fix) {
+				t.Errorf("%s (0x%x) overlaps 0x%x-0x%x", s.name, s.va, o[0], o[1])
+			}
+		}
+	}
+}
+
 func readOrSkip(t *testing.T, path string) []byte {
 	t.Helper()
 	b, err := os.ReadFile(path)
@@ -57,8 +105,21 @@ func TestPatchRealLibrary(t *testing.T) {
 	if SHA256Hex(got) != FixSHA256 {
 		t.Fatalf("patched sha256 %s, want %s", SHA256Hex(got), FixSHA256)
 	}
+	// the companion's library has steps 1 and 2 only: equal to ours once the template sites are applied to it
+	if SHA256Hex(want) != companionFixSHA256 {
+		t.Fatalf("%s sha256 %s, want %s", fixLib, SHA256Hex(want), companionFixSHA256)
+	}
+	for _, s := range templateSites {
+		copy(want[s.va-textDelta:], s.fix)
+	}
 	if !bytes.Equal(got, want) {
-		t.Fatalf("patched library differs from %s", fixLib)
+		t.Fatalf("patched library differs from %s plus the template sites", fixLib)
+	}
+	for _, s := range templateSites {
+		off := s.va - textDelta
+		if !bytes.Equal(keep[off:off+len(s.orig)], s.orig) || !bytes.Equal(got[off:off+len(s.fix)], s.fix) {
+			t.Errorf("%s (0x%x): original %x, patched %x", s.name, s.va, keep[off:off+len(s.orig)], got[off:off+len(s.fix)])
+		}
 	}
 	if !bytes.Equal(orig, keep) {
 		t.Fatal("Patch modified its input")

From 45fad4b337858d16e6852014e527ab3acd48416d Mon Sep 17 00:00:00 2001
From: qiyinxi <qiyinxi@foxmail.com>
Date: Sat, 7 Nov 2026 16:46:10 +0100
Subject: [PATCH 2/2] =?UTF-8?q?ARM=20=E8=BD=AC=E8=AF=91=E5=B1=82=E8=A1=A5?=
 =?UTF-8?q?=E4=B8=81=EF=BC=9A=E5=BC=80=E6=9C=BA=E6=97=B6=E6=8A=8A=20HINT?=
 =?UTF-8?q?=20=E8=A7=A3=E7=A0=81=E8=A1=A5=E4=B8=81=E5=92=8C=E5=AE=A2?=
 =?UTF-8?q?=E4=BD=93=E9=A9=B1=E5=8A=A8=E5=BA=93=E8=A1=A5=E4=B8=81=E4=B8=80?=
 =?UTF-8?q?=E8=B5=B7=E6=8C=82=E4=B8=8A?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

World of Airports 3.7.3（Unity 6000.3）在 libndk_translation.so 里撞上 SEVL（0xd50320bf）抛 SIGILL，
启动约 2 秒闪退。Google 的转译层 0.2.3 把 HINT 空间里的 WFE、WFI、SEV、SEVL 当成未定义指令，
按 ARM 规范它们可以按 NOP 执行。

- 新增 ndkfix：在本机从镜像自带的 /system/lib64/libndk_translation.so（a2086fbc…）生成补丁版，
  三套解码器（重优化器、轻转译器、解释器）各改一处 6 字节（jbe rel32 → 6 字节 NOP），
  其余未定义编码照旧 SIGILL。build-id、动态符号、GOT、数据区都不动，执行桥的门控和 fork 保护照常。
  补丁库 sha256 3efa8977…，只在本机生成，不分发。
- 新增 guestpatch，把客体驱动库补丁和转译层补丁做成同一种 profile；客体脚本 libfix.sh 在一次
  root 运行里先只读检查全部、有要上传的就一个都不挂，再逐个 bind mount、核哈希，只要新挂上了
  任何一个就 setprop ctl.restart zygote 一次。原来的 vulkanfix 编排改成 guestfix。
- 选补丁按实例自己的配置（inst.Config），缺 abi.type 时按 x86_64 处理，不再重读 config.ini。

测试：ndkfix 真库逐字节比对、补丁点 golden、错误输入；libfix.sh 用 Git 的 sh 加假根目录跑
（两组都挂只 setprop 一次、有上传就不挂、镜像不对、目标不存在、缓存坏、挂载失败、已挂）；
guestfix 用假客体跑多 profile 的 launched / owed / adopted。变异检查：去掉输入哈希检查、少改一处
补丁点、去掉「有上传就不挂」、每组各 setprop、owed 时不过闸，单测都会失败。实机在 flow-b 冷启动，
两个补丁一次挂上、zygote 只重启一次，WoA 不再出 0xd50320bf，走到登录界面和机场。

Refs ModAVD/ModAVD#131
Refs ModAVD/ModAVD#130
---
 README.en.md                           |   6 +-
 README.md                              |   6 +-
 internal/cli/commands.go               |   2 +-
 internal/cli/format.go                 |   4 +-
 internal/cli/format_test.go            |   6 +-
 internal/emu/afterboot.go              |  23 +-
 internal/emu/bridge.go                 |   2 +-
 internal/emu/guestfix.go               | 667 ++++++++++++++++++++++++
 internal/emu/guestfix_test.go          | 669 +++++++++++++++++++++++++
 internal/emu/start.go                  |  35 +-
 internal/emu/start_test.go             |   6 +-
 internal/emu/types.go                  |   7 +-
 internal/emu/vulkanfix.go              | 533 --------------------
 internal/emu/vulkanfix_test.go         | 462 -----------------
 internal/guest/guest.go                |   4 +-
 internal/guest/guest_test.go           |  10 +-
 internal/guest/libfix_sh_test.go       | 352 +++++++++++++
 internal/guest/scripts/libfix.sh       | 115 +++++
 internal/guest/scripts/vulkanfix.sh    |  45 --
 internal/guestpatch/guestpatch.go      |  66 +++
 internal/guestpatch/guestpatch_test.go |  56 +++
 internal/mcp/mcp_test.go               |   2 +-
 internal/mcp/tools.go                  |   8 +-
 internal/ndkfix/ndkfix.go              | 165 ++++++
 internal/ndkfix/ndkfix_test.go         | 267 ++++++++++
 internal/ui/web/dev/mock.js            |   4 +-
 internal/ui/web/js/panels.js           |   2 +-
 internal/vkfix/profile.go              |  27 -
 28 files changed, 2423 insertions(+), 1128 deletions(-)
 create mode 100644 internal/emu/guestfix.go
 create mode 100644 internal/emu/guestfix_test.go
 delete mode 100644 internal/emu/vulkanfix.go
 delete mode 100644 internal/emu/vulkanfix_test.go
 create mode 100644 internal/guest/libfix_sh_test.go
 create mode 100644 internal/guest/scripts/libfix.sh
 delete mode 100644 internal/guest/scripts/vulkanfix.sh
 create mode 100644 internal/guestpatch/guestpatch.go
 create mode 100644 internal/guestpatch/guestpatch_test.go
 create mode 100644 internal/ndkfix/ndkfix.go
 create mode 100644 internal/ndkfix/ndkfix_test.go
 delete mode 100644 internal/vkfix/profile.go

diff --git a/README.en.md b/README.en.md
index c9e19b5..8900907 100644
--- a/README.en.md
+++ b/README.en.md
@@ -47,7 +47,7 @@ Both programs share the implementation under `internal/`:
 | `emu` | Start, post-boot tuning, first-boot initialization, execution bridge, shutdown, status, computer check | `manager.py`, `precheck.py` |
 | `adb` | Private adb server, re-registration, emulator console | `host.py` |
 | `win` | Processes, command lines, ports, launching detached from the process tree, file locks | `host.py`, `windows/process.py` |
-| `vkfix`, `apk`, `guest` | Guest Vulkan driver patch, APK manifest, scripts pushed into the guest | `vulkanfix.py`, `res/avd/guest/` |
+| `vkfix`, `ndkfix`, `guestpatch`, `apk`, `guest` | Guest Vulkan driver patch, ARM translation layer patch (WFE / WFI / SEV / SEVL as NOP) and the list of both, APK manifest, scripts pushed into the guest | `vulkanfix.py`, `res/avd/guest/` |
 | `cli`, `mcp`, `ui` | The CLI, MCP, and the manager's HTTP server and pages | — |
 
 `internal/guest/scripts/*.sh` and the scripts under AUTO-MAS `res/avd/guest/` are the same files; change both together.
@@ -159,7 +159,7 @@ On Apple Silicon macOS, downloads and imports use Android 15 Google Play `arm64-
   - Shut down every instance of the root folder before you change it. Do not add a root folder that sets `portBase` to AUTO-MAS.
 - The emulator, the adb server and logcat are all launched through an intermediate process that exits immediately, so they are not in modavd's process tree: if the caller ends modavd (Ctrl+C, the MCP client disconnects), the emulator is not taken down with it.
 - A separate `tools\modavd.exe` process writes logcat to `logs\logcat-mas_<i>-<time>.txt` and continues after the start command or manager exits. When that boot's qemu exits, the capture process ends its own adb client and exits. At 256 MiB it rotates at the next newline and writes the same adb stream to a new file. Closed segments follow the existing limits of 10 per instance and 1 GiB across `logs\`; the active file is excluded.
-- After a successful start, each instance also gets a boot guardian that is likewise outside the process tree and exits when qemu exits. After the guest restarts on its own (qemu keeps running), the guardian redoes the post-boot tuning and the Vulkan patch, and never launches a new emulator.
+- After a successful start, each instance also gets a boot guardian that is likewise outside the process tree and exits when qemu exits. After the guest restarts on its own (qemu keeps running), the guardian redoes the post-boot tuning and the guest library patches (Vulkan driver, ARM translation layer), and never launches a new emulator.
 - Starts and shutdowns of the same instance queue on `<root>\avd\.mas_<i>.{start,boot,stop}.lock`: a start waits for the previous start and shutdown to finish; a shutdown can interrupt an instance that is starting.
 
 **Host scheduling in the post-boot tuning**:
@@ -311,7 +311,7 @@ Tests run on Windows only. Optional environment variables:
 | `MODAVD_TEST_LIVE` | Set to `1` to run the tests that touch the real environment: looking at the emulators currently running on this machine, and starting a real adb server. They touch instances in use on this machine, so do not set it normally. |
 
 - Some tests in `internal/avd`, `internal/root` and `internal/jsonord` run the original AUTO-MAS logic with Python 3 (such as `internal/avd/testdata/instances_ref.py`) and compare it with the Go output byte for byte, so Python 3 must be installed.
-- A few tests only read existing files under `D:\ModAVD` on this machine (`mas-avd.json`, instance configs, component APKs) and are skipped if they are absent. `MODAVD_TEST_METADATA` can point to a different `mas-avd.json`, `MODAVD_TEST_SDK` to a different SDK that has `platform-tools\adb.exe`, and `MODAVD_TEST_VKLIBS` to a folder holding the original and the patched `libvulkan_enc.so` (the byte-for-byte comparison for the Vulkan fix).
+- A few tests only read existing files under `D:\ModAVD` on this machine (`mas-avd.json`, instance configs, component APKs) and are skipped if they are absent. `MODAVD_TEST_METADATA` can point to a different `mas-avd.json`, `MODAVD_TEST_SDK` to a different SDK that has `platform-tools\adb.exe`, and `MODAVD_TEST_VKLIBS` to a folder holding the original and the patched `libvulkan_enc.so` (the byte-for-byte comparison for the Vulkan fix), and `MODAVD_TEST_NDKLIBS` to a folder holding the image's `libndk_translation.so` and the patched `libndk_translation.hintnop1.so` (the same for the ARM translation layer patch).
 - CI (`.github/workflows/ci.yml`) runs on `windows-2025`: format check, `go vet`, `go test`, `build.ps1`, the privacy scan and the author check. It runs only on PRs or when triggered manually.
 
 ## Standalone download and hashes
diff --git a/README.md b/README.md
index ff7be03..e5e08a1 100644
--- a/README.md
+++ b/README.md
@@ -47,7 +47,7 @@
 | `emu` | 开机、开机后调优、首次初始化、执行桥、关机、状态、电脑检查 | `manager.py`、`precheck.py` |
 | `adb` | 私有 adb server、重新登记、模拟器控制台 | `host.py` |
 | `win` | 进程、命令行、端口、脱离进程树的启动、文件锁 | `host.py`、`windows/process.py` |
-| `vkfix`、`apk`、`guest` | 客体 Vulkan 驱动补丁、APK 清单、推进客体的脚本 | `vulkanfix.py`、`res/avd/guest/` |
+| `vkfix`、`ndkfix`、`guestpatch`、`apk`、`guest` | 客体 Vulkan 驱动补丁、ARM 转译层补丁（WFE / WFI / SEV / SEVL 当 NOP）和这两个补丁的清单、APK 清单、推进客体的脚本 | `vulkanfix.py`、`res/avd/guest/` |
 | `cli`、`mcp`、`ui` | 命令行、MCP、管理器的 HTTP 服务和页面 | — |
 
 `internal/guest/scripts/*.sh` 和 AUTO-MAS `res/avd/guest/` 下的脚本是同一份，改的时候两边要一起改。
@@ -165,7 +165,7 @@ Apple Silicon macOS 的下载与导入使用 Android 15 Google Play `arm64-v8a`
   - 改之前先关掉这个根目录的所有实例。设了 `portBase` 的根目录不要加进 AUTO-MAS。
 - 模拟器、adb server、logcat 都经一个立即退出的中间进程拉起，不在 modavd 的进程树里：调用方结束 modavd（Ctrl+C、MCP 客户端断开）不会带走模拟器。
 - 宿主 logcat 由 `tools\modavd.exe` 的独立采集进程写入 `logs\logcat-mas_<i>-<时间>.txt`，启动命令或管理器退出后仍继续；这次开机的 qemu 退出后，采集进程主动结束自己的 adb 并退出。每满 256 MiB 在下一处换行切分，同一条 adb 输出流接着写新文件；关闭的分段每台留最新 10 份，并计入 `logs\` 的 1 GiB 清理上限，正在写的文件不计入。
-- 开机成功后，每台实例另有一个同样不在进程树里的开机守护，随 qemu 退出而结束。客体自己重启（qemu 没退）后，它补做开机调优和 Vulkan 补丁，绝不拉起新的模拟器。
+- 开机成功后，每台实例另有一个同样不在进程树里的开机守护，随 qemu 退出而结束。客体自己重启（qemu 没退）后，它补做开机调优和客体库补丁（Vulkan 驱动、ARM 转译层），绝不拉起新的模拟器。
 - 同一实例的开机、关机按 `<根>\avd\.mas_<i>.{start,boot,stop}.lock` 排队：开机等前一次开机和关机做完；关机可以打断正在开机的实例。
 
 **开机后调优里的宿主调度**：
@@ -313,7 +313,7 @@ go test ./...
 | `MODAVD_TEST_LIVE` | 设成 `1` 才跑碰真实环境的测试：看本机正在运行的模拟器、起真的 adb server。会碰到本机正在用的实例，平时不要设。 |
 
 - `internal/avd`、`internal/root`、`internal/jsonord` 有一部分测试用 Python 3 运行 AUTO-MAS 的原始逻辑（如 `internal/avd/testdata/instances_ref.py`），和 Go 的输出逐字节对照，所以要装 Python 3。
-- 有几项测试只读本机 `D:\ModAVD` 下的现成文件（`mas-avd.json`、实例配置、组件 APK），没有就跳过；`MODAVD_TEST_METADATA` 可以另指一份 `mas-avd.json`，`MODAVD_TEST_SDK` 另指一个带 `platform-tools\adb.exe` 的 SDK，`MODAVD_TEST_VKLIBS` 指向放着原版和打过补丁的 `libvulkan_enc.so` 的目录（Vulkan 修复的逐字节对照）。
+- 有几项测试只读本机 `D:\ModAVD` 下的现成文件（`mas-avd.json`、实例配置、组件 APK），没有就跳过；`MODAVD_TEST_METADATA` 可以另指一份 `mas-avd.json`，`MODAVD_TEST_SDK` 另指一个带 `platform-tools\adb.exe` 的 SDK，`MODAVD_TEST_VKLIBS` 指向放着原版和打过补丁的 `libvulkan_enc.so` 的目录（Vulkan 修复的逐字节对照），`MODAVD_TEST_NDKLIBS` 指向放着镜像原版 `libndk_translation.so` 和补丁版 `libndk_translation.hintnop1.so` 的目录（ARM 转译层补丁的逐字节对照）。
 - CI（`.github/workflows/ci.yml`）在 `windows-2025` 上跑格式检查、`go vet`、`go test`、`build.ps1`、隐私扫描和作者检查；只在 PR 或手动触发时运行。
 
 ## 单独下载与哈希
diff --git a/internal/cli/commands.go b/internal/cli/commands.go
index f5c6b55..0585a2c 100644
--- a/internal/cli/commands.go
+++ b/internal/cli/commands.go
@@ -198,7 +198,7 @@ func init() {
 				"带了 --window 或 --headless 而它不是这种方式，就报错（busy），不接管也不重启，要换先 stop 再 start；" +
 				"两个都不带就照它现在的方式接管。第一次开机还会做首次初始化。" +
 				"按 Ctrl+C 或 --timeout 到点都只是不再等：模拟器不会被结束，会接着开机。" +
-				"之后再运行一次 start 会接管它，把这次开机还没做完的设置补完（包括首次初始化和客体 Vulkan 修复）。" +
+				"之后再运行一次 start 会接管它，把这次开机还没做完的设置补完（包括首次初始化和客体库补丁）。" +
 				"实例已经在运行、设置也都做完时，只重做每次开机都做的设置。" +
 				"返回前确认 /sdcard 能写进文件（一般这时早已就绪，不多花时间；最多再等 60 秒，到点只警告）。" +
 				"实例还没有 arm64 执行桥时，设置做完后自动装上（中间关机再开机一两次）；--no-bridge 这次不装，" +
diff --git a/internal/cli/format.go b/internal/cli/format.go
index c274689..28ed390 100644
--- a/internal/cli/format.go
+++ b/internal/cli/format.go
@@ -412,10 +412,10 @@ func formatStart(w io.Writer, r *emu.StartResult) {
 		fmt.Fprintln(w, "已完成首次初始化")
 	}
 	if r.ZygoteRestarted {
-		fmt.Fprintln(w, "挂上了客体 Vulkan 修复，zygote 已重启（应用都重新开始）")
+		fmt.Fprintln(w, "挂上了客体库补丁（Vulkan 驱动、ARM 转译层），zygote 已重启（应用都重新开始）")
 	}
 	if r.SetupPending {
-		fmt.Fprintf(w, "这次开机的一次性设置（首次初始化、客体 Vulkan 修复）还没做完，再运行一次 modavd start %d 补完\n",
+		fmt.Fprintf(w, "这次开机的一次性设置（首次初始化、客体库补丁）还没做完，再运行一次 modavd start %d 补完\n",
 			in.Index)
 	}
 	if r.LogFile != "" {
diff --git a/internal/cli/format_test.go b/internal/cli/format_test.go
index 5950899..a1b146d 100644
--- a/internal/cli/format_test.go
+++ b/internal/cli/format_test.go
@@ -192,7 +192,7 @@ func TestFormatStart(t *testing.T) {
 	want := "实例 3（星铁）已开机：开机 31.2 秒，合计 58.0 秒\n" +
 		"adb 地址：127.0.0.1:20031（私有 adb server 上是 emulator-20030）\n" +
 		"已完成首次初始化\n" +
-		"挂上了客体 Vulkan 修复，zygote 已重启（应用都重新开始）\n" +
+		"挂上了客体库补丁（Vulkan 驱动、ARM 转译层），zygote 已重启（应用都重新开始）\n" +
 		"模拟器日志：D:\\r\\logs\\mas_3-1.log\n" +
 		"警告：idlepoll 没装上\n"
 	if buf.String() != want {
@@ -208,7 +208,7 @@ func TestFormatStart(t *testing.T) {
 	}
 	buf.Reset()
 	formatStart(&buf, &emu.StartResult{Instance: sampleInstance(2), TotalSeconds: 3, SetupPending: true})
-	if !strings.Contains(buf.String(), "\n这次开机的一次性设置（首次初始化、客体 Vulkan 修复）还没做完，再运行一次 modavd start 2 补完\n") {
+	if !strings.Contains(buf.String(), "\n这次开机的一次性设置（首次初始化、客体库补丁）还没做完，再运行一次 modavd start 2 补完\n") {
 		t.Errorf("setup pending: %q", buf.String())
 	}
 }
@@ -217,7 +217,7 @@ func TestFormatStart(t *testing.T) {
 func TestStartHelpTellsWhatCancelDoes(t *testing.T) {
 	start := entryOf(findCommand("start"))
 	for _, s := range []string{"Ctrl+C", "--timeout 到点", "模拟器不会被结束，会接着开机", "再运行一次 start 会接管它",
-		"首次初始化和客体 Vulkan 修复"} {
+		"首次初始化和客体库补丁"} {
 		if !strings.Contains(start.Details, s) {
 			t.Errorf("start details lack %q: %s", s, start.Details)
 		}
diff --git a/internal/emu/afterboot.go b/internal/emu/afterboot.go
index 23d8906..44691bd 100644
--- a/internal/emu/afterboot.go
+++ b/internal/emu/afterboot.go
@@ -49,8 +49,8 @@ type afterBootResult struct {
 	HostIME         bool
 	ZygoteRestarted bool
 	LogcatFile      string
-	// SetupPending: the Vulkan fix this boot still needs was left out (an app was in the foreground or an install was
-	// running, see ensureVulkanFix); the setup marker has to stay so that a later start mounts it.
+	// SetupPending: a guest library fix this boot still needs was left out (an app was in the foreground or an install
+	// was running, see ensureGuestFixes); the setup marker has to stay so that a later start mounts it.
 	SetupPending bool
 }
 
@@ -58,15 +58,15 @@ type afterBootResult struct {
 type bootSetup int
 
 const (
-	// setupAdopted: the instance was already running and nothing is owed: the guest Vulkan fix is only checked (the
-	// zygote restart of mounting it would end the game running there). Windows can identify the IME channel by
+	// setupAdopted: the instance was already running and nothing is owed: the guest library fixes are only checked
+	// (the zygote restart of mounting them would end the game running there). Windows can identify the IME channel by
 	// its build; other hosts cannot confirm it from an unverified old emulator log.
 	setupAdopted bootSetup = iota
 	// setupLaunched: this call launched qemu; nobody can have used the guest yet, so everything runs.
 	setupLaunched
 	// setupOwed: this call adopts the qemu of an earlier start that ended before finishing (the setup marker, see
-	// Start). Everything runs as after a launch, except that the guest may be in use meanwhile: the Vulkan fix is
-	// mounted only while no app is in the foreground and no install holds the guest lock (owedMountGate).
+	// Start). Everything runs as after a launch, except that the guest may be in use meanwhile: the guest library
+	// fixes are mounted only while no app is in the foreground and no install holds the guest lock (owedMountGate).
 	setupOwed
 )
 
@@ -75,7 +75,7 @@ const (
 // Ordinary failures are only warnings; an unsupported host API stops the boot. ctx is checked between the steps
 // (errs.Canceled then). mode
 // says what this boot is owed (bootSetup); until is the deadline of its setup marker (zero without one), which the
-// warning of a deferred Vulkan fix names.
+// warning of a deferred guest library fix names.
 //
 // Not done any more (as in AUTO-MAS): `gsm meter on|off` (each call makes the image's MeterService install a 2 GB
 // test plan, i.e. it creates the limit), and /data nobarrier (replaced by disk write-through at launch).
@@ -197,12 +197,13 @@ func (m *Manager) afterBoot(ctx context.Context, inst *avd.Instance, mode bootSe
 		// 10) orientation: the display stays landscape (persistent; set every boot so old instances get it)
 		func() { m.setupOrientation(ctx, i) },
 		// 10b) hand the clusters the guest freed back to the host, at most once a day (best effort, see autotrim.go);
-		//      before the Vulkan fix, whose zygote restart is deliberately the last step
+		//      before the guest library fixes, whose zygote restart is deliberately the last step
 		func() { m.autoTrim(ctx, i, mode) },
 		func() {
-			// 11) the guest Vulkan fix. Must be last: mounting it restarts zygote, system_server and every app
-			prog.emit("vulkan_fix", fmt.Sprintf("实例 %d 客体 Vulkan 驱动补丁", i), progressVulkanFix)
-			restarted, pending := m.ensureVulkanFix(ctx, i, mode, until)
+			// 11) the guest library fixes (Vulkan driver, ARM translation layer). Must be last: mounting them restarts
+			//     zygote, system_server and every app. The progress step keeps its name vulkan_fix (API, GUI, create)
+			prog.emit("vulkan_fix", fmt.Sprintf("实例 %d 客体库补丁（Vulkan 驱动、ARM 转译层）", i), progressVulkanFix)
+			restarted, pending := m.ensureGuestFixes(ctx, inst, mode, until)
 			r.SetupPending = pending
 			if !restarted {
 				return
diff --git a/internal/emu/bridge.go b/internal/emu/bridge.go
index a471c7f..e49519e 100644
--- a/internal/emu/bridge.go
+++ b/internal/emu/bridge.go
@@ -512,7 +512,7 @@ func (m *Manager) bridgeUpdateBlocked(ctx context.Context, i int) (mountBlocker,
 		return installBlocker(err), true
 	}
 	l.Unlock()
-	if allowed, front := vulkanFixMountAllowed(m.shell(ctx, i, foregroundProbeScript, 0).Out); !allowed {
+	if allowed, front := guestFixMountAllowed(m.shell(ctx, i, foregroundProbeScript, 0).Out); !allowed {
 		return foregroundBlocker(front), true
 	}
 	return mountBlocker{}, false
diff --git a/internal/emu/guestfix.go b/internal/emu/guestfix.go
new file mode 100644
index 0000000..6e36fff
--- /dev/null
+++ b/internal/emu/guestfix.go
@@ -0,0 +1,667 @@
+package emu
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"modavd/internal/adb"
+	"modavd/internal/avd"
+	"modavd/internal/guest"
+	"modavd/internal/guestpatch"
+	"modavd/internal/host"
+	"modavd/internal/root"
+)
+
+const (
+	guestFixScriptTimeout = 60 * time.Second
+	frameworkBackTimeout  = 120 * time.Second
+)
+
+// guestLibFixes uses the instance's configured ABI, never the host OS. The instance was read successfully by the
+// start path, so use that snapshot instead of opening config.ini a second time; a missing abi.type is the legacy
+// x86_64 default used by the manager's bridge support checks.
+func (m *Manager) guestLibFixes(inst *avd.Instance) ([]guestpatch.Profile, error) {
+	if inst == nil || inst.Config == nil {
+		return nil, fmt.Errorf("读取实例客体架构: 实例配置为空")
+	}
+	abi := inst.Config.Value("abi.type")
+	if abi == "" {
+		abi = "x86_64"
+	}
+	profiles := guestpatch.ForABI(abi)
+	if len(profiles) == 0 {
+		if abi == "arm64-v8a" {
+			return nil, fmt.Errorf("ARM64 客体直接跑 ARM 代码，没有 ARM 转译层；API35 的 Vulkan 补丁也尚未验收，保留镜像原库，" +
+				"不套用 API34 补丁，也不挂载或重启 zygote")
+		}
+		return nil, fmt.Errorf("客体架构 %q 没有适用的客体库补丁", abi)
+	}
+	return profiles, nil
+}
+
+// ensureGuestFixes bind-mounts the patched guest libraries made on this host over the image's own and restarts
+// zygote once, for verified API34 x86_64 guests (internal/guestpatch):
+//   - the Vulkan encoder /vendor/lib64/libvulkan_enc.so (AUTO-MAS _ensure_vulkan_fix; launcher -VulkanFix; user
+//     10-16): Star Rail's descriptor templates (khrfix) and Endfield's unlocked vkBindImageMemory lookups (bindlock);
+//   - the ARM translation layer /system/lib64/libndk_translation.so (ModAVD/ModAVD#131): WFE, WFI, SEV and SEVL run as
+//     NOP instead of SIGILL (Unity 6 spin locks, World of Airports). zygote loads it before it forks any app, with or
+//     without the execution bridge (whose shim opens the same path and hands apps off the gate list back to it).
+//
+// Games that use none of these paths are unaffected. ARM64 guests run ARM code natively, and API35's Vulkan has not
+// been validated: they keep their original libraries.
+//
+//   - libfix.sh first checks every library: whether this boot already has something mounted over it (nothing to do
+//     then), and the image library's hash against the profile; the patched copies are cached in the guest's
+//     /data/local/tmp, so the next boot mounts them without an upload. All of them are mounted in one run, followed
+//     by the one zygote restart (a mount left without it would read as done while zygote runs the old file).
+//   - Without a guest cache the host copy in <root>\guest-patches is pushed; without that, the guest's own library is
+//     pulled and patched here (patchedGuestLibrary). The patched files are never shipped.
+//   - An instance that was already running (setupAdopted) is only checked: the zygote restart would end the game. A
+//     missing fix is a warning then (it reaches StartResult.Warnings), since that whole boot runs without it.
+//   - A boot whose setup an earlier start left unfinished (setupOwed) may have been put to use since: AUTO-MAS
+//     launched a game on it, an MCP client went on with it (install_apk among others), a user plays in the window.
+//     Each libfix.sh run that may mount first passes owedMountGate (no install holds the guest lock, and
+//     guestFixMountAllowed finds the guest unused: home screen, SystemUI or nothing in front); otherwise nothing is
+//     mounted and, when a fix is still missing, pending=true: the setup marker stays and the result says
+//     SetupPending, so a start after the app is closed or the install is done (before until, the marker's deadline)
+//     mounts it, or the next boot does.
+//
+// Nothing is written to the image: the mounts end with the guest's shutdown (libfix.sh revert takes them away within
+// a boot). Failures are only logged. Returns whether zygote was restarted, and whether a fix is still owed.
+func (m *Manager) ensureGuestFixes(ctx context.Context, inst *avd.Instance, mode bootSetup, until time.Time) (restarted, pending bool) {
+	i := inst.Index
+	profiles, err := m.guestLibFixes(inst)
+	if err != nil {
+		m.Log.Warnf("实例 %d 客体库补丁未执行: %v", i, err)
+		return false, false
+	}
+	if mode == setupAdopted {
+		res := m.shell(ctx, i, guestFixCheckScript(profiles), 0)
+		for _, r := range guestFixCheckReports(i, res.Out, profiles) {
+			m.logReport(r)
+		}
+		return false, false
+	}
+	remote, ok := m.pushGuestScript(ctx, i, guest.LibFix)
+	if !ok {
+		m.Log.Warnf("实例 %d 客体库补丁没挂: 推送客体脚本失败", i)
+		return false, false
+	}
+	g := m.guestIO(ctx, i)
+	return m.mountGuestFixes(ctx, i, guestFixIO{
+		guestIO: g,
+		remote:  remote,
+		library: func(p guestpatch.Profile) string { return m.patchedGuestLibrary(ctx, i, p) },
+		waitBack: func(uiBefore string) bool {
+			return m.waitFrameworkBack(ctx, g, uiBefore, frameworkBackTimeout)
+		},
+	}, profiles, mode == setupOwed, until)
+}
+
+// guestFixIO is what mountGuestFixes works through: the instance's adb in Manager, a fake guest in tests.
+type guestFixIO struct {
+	guestIO
+	remote   string                            // libfix.sh in the guest (pushed already)
+	library  func(p guestpatch.Profile) string // the host's patched copy (patchedGuestLibrary); "" when it cannot be had
+	waitBack func(uiBefore string) bool        // after the zygote restart (waitFrameworkBack)
+}
+
+// report is one log line: a warning or an info.
+type report struct {
+	warn bool
+	msg  string
+}
+
+func (m *Manager) logReport(r report) {
+	if r.warn {
+		m.Log.Warnf("%s", r.msg)
+	} else {
+		m.Log.Infof("%s", r.msg)
+	}
+}
+
+// mountBlocker is why an owed fix is not mounted now, for the messages: what is in the way ("有应用在前台"), what to
+// do before the next start ("关掉应用后") and details ("" none).
+type mountBlocker struct {
+	what, then, detail string
+}
+
+// foregroundBlocker: guestFixMountAllowed refused (front as it returned it, "" when unreadable).
+func foregroundBlocker(front string) mountBlocker {
+	b := mountBlocker{what: "有应用在前台", then: "关掉应用后", detail: "前台: " + front}
+	if front == "" {
+		b.detail = "读不出前台是什么，按有应用在用处理"
+	}
+	return b
+}
+
+// installBlocker: the guest lock is held (err == nil) or cannot be taken for another reason, which counts the same
+// (a needless deferral costs one more start, a wrong guess breaks an install).
+func installBlocker(err error) mountBlocker {
+	b := mountBlocker{what: "有安装正在进行", then: "等安装完"}
+	if err != nil {
+		b.detail = fmt.Sprintf("安装锁读不了（%v），按有安装正在进行处理", err)
+	}
+	return b
+}
+
+// owedMountGate is passed right before each libfix.sh run that may mount an owed fix (and so restart zygote, which
+// ends every app and breaks an install that is running):
+//   - the guest lock (guestLockPath), which InstallAPK holds while it installs: taken with TryLock, never waited
+//     for (an install of a 3 GB game takes minutes, a start should not);
+//   - then the foreground rule (guestFixMountAllowed), read again at every call: the patched library may have taken
+//     tens of seconds to make and upload since the last one, and a game may have been launched meanwhile.
+//
+// ok: both allow it, and release frees the lock right after that run returns: the restart has been triggered by
+// then, and an install started after it only meets a framework that is coming back (what InstallAPK's own boot check
+// and adb's errors report). Otherwise b says what is in the way and nothing is held.
+func (m *Manager) owedMountGate(i int, g guestIO) (release func(), b mountBlocker, ok bool) {
+	l, free, err := host.TryLock(m.guestLockPath(i))
+	if err != nil || !free {
+		return nil, installBlocker(err), false
+	}
+	probe := g.shell(foregroundProbeScript, 0)
+	allowed, front := guestFixMountAllowed(probe.Out)
+	if !allowed {
+		l.Unlock()
+		m.Log.Debugf("实例 %d 前台检查: %s", i, orText(tail(joinNonEmptyLines(probe.Out, " | "), 300), "无输出"))
+		return nil, foregroundBlocker(front), false
+	}
+	m.Log.Infof("实例 %d 这次开机的客体库补丁还没做，前台是 %s、没有应用在用，也没有安装在进行，接着挂（会重启 zygote）",
+		i, front)
+	return l.Unlock, mountBlocker{}, true
+}
+
+// libFixMountCommand runs `libfix.sh mount` as root for profiles.
+func libFixMountCommand(remote string, profiles []guestpatch.Profile) string {
+	var b strings.Builder
+	b.WriteString("su 0 sh " + remote + " mount")
+	for _, p := range profiles {
+		for _, a := range []string{p.GuestPath, p.CachePath, p.UploadPath, p.OrigSHA256, p.FixSHA256} {
+			b.WriteString(" " + a)
+		}
+	}
+	return b.String()
+}
+
+// mountGuestFixes is the mounting part of ensureGuestFixes (a launched boot, or an owed one, owed=true: every run
+// that may mount passes owedMountGate first; until is the marker's deadline for the messages). Returns whether zygote
+// was restarted and whether an owed fix is still owed (deferred while the guest is in use).
+func (m *Manager) mountGuestFixes(ctx context.Context, i int, fx guestFixIO, profiles []guestpatch.Profile, owed bool,
+	until time.Time) (restarted, pending bool) {
+	// gatedFix is one libfix.sh run over ps, for an owed fix only once owedMountGate allows it, with the guest lock
+	// held over the run. ok=false: deferred (logged here) and nothing ran.
+	gatedFix := func(ps []guestpatch.Profile, first bool) (out string, ok, pending bool) {
+		var release func()
+		var b mountBlocker
+		allowed := false
+		if owed {
+			release, b, allowed = m.owedMountGate(i, fx.guestIO)
+		} else {
+			// A launched boot has no app of ours in front yet, but an install_apk of another modavd process may already
+			// run (sys.boot_completed is 1 by now): the guest lock alone decides, the same way.
+			l, free, err := host.TryLock(m.guestLockPath(i))
+			if err == nil && free {
+				release, allowed = l.Unlock, true
+			} else {
+				b = installBlocker(err)
+			}
+		}
+		if allowed {
+			defer release()
+			return fx.shell(libFixMountCommand(fx.remote, ps), guestFixScriptTimeout).Out, true, false
+		}
+		if !first {
+			// the first run said NEED_UPLOAD and mounted nothing: ps all want mounting. The uploads stay in the guest,
+			// so the start that mounts them does not upload again (libfix.sh takes them into its cache).
+			m.Log.Warnf("%s", guestFixDeferredMessage(i, ps, b, b.detail, until, time.Now()))
+			return "", false, true
+		}
+		res := fx.shell(guestFixCheckScript(ps), 0)
+		pending, reports := guestFixDeferredReport(i, res.Out, b, until, time.Now(), ps)
+		for _, r := range reports {
+			m.logReport(r)
+		}
+		return "", false, pending
+	}
+
+	uiBefore := strings.TrimSpace(fx.shell("pidof com.android.systemui", 0).Out)
+	out, ok, pending := gatedFix(profiles, true)
+	if !ok {
+		return false, pending
+	}
+	m.Log.Infof("实例 %d 客体库补丁 第 1 步（客体检查）: %s", i, orText(joinNonEmptyLines(out, "；"), "无输出"))
+	status := libFixStatus(out, profiles)
+	uploadFailed := map[string]bool{}
+	var next []guestpatch.Profile // a second run: the libraries ready and the ones uploaded now
+	needUpload := false
+	for _, p := range profiles {
+		switch kind, _ := libFixKind(status[p.GuestPath]); kind {
+		case "READY":
+			next = append(next, p)
+		case "NEED_UPLOAD":
+			needUpload = true
+			if m.uploadGuestFix(i, fx, p) {
+				next = append(next, p)
+			} else {
+				uploadFailed[p.GuestPath] = true
+			}
+		}
+	}
+	if needUpload {
+		if len(next) == 0 {
+			return false, false
+		}
+		if out, ok, pending = gatedFix(next, false); !ok {
+			return false, pending
+		}
+		m.Log.Infof("实例 %d 客体库补丁 第 3 步（挂载）: %s", i, orText(joinNonEmptyLines(out, "；"), "无输出"))
+		second := libFixStatus(out, next)
+		for _, p := range next {
+			if s, ok := second[p.GuestPath]; ok {
+				status[p.GuestPath] = s
+			} else {
+				delete(status, p.GuestPath) // no line this time: reported as such below
+			}
+		}
+	}
+
+	var mounted []string
+	for _, p := range profiles {
+		if uploadFailed[p.GuestPath] {
+			continue // warned already
+		}
+		r, ok := guestFixResult(i, p, status[p.GuestPath], out)
+		m.logReport(r)
+		if ok {
+			mounted = append(mounted, p.Name)
+		}
+	}
+	if lastNonEmptyLine(out) != "RESTARTED" {
+		return false, false
+	}
+
+	started := time.Now()
+	back := fx.waitBack(uiBefore)
+	if ctx.Err() != nil {
+		return true, false // canceled while waiting: zygote did restart, but nothing is known about the framework
+	}
+	how := "超时未回来"
+	if back {
+		how = "已回来"
+	}
+	m.Log.Infof("实例 %d 客体库补丁已挂上（%s），zygote 重启后系统界面%s（%.0f 秒）", i, strings.Join(mounted, "、"), how,
+		time.Since(started).Seconds())
+	return true, false
+}
+
+// uploadGuestFix pushes the host's patched copy of p to p.UploadPath (patchedGuestLibrary makes it when needed).
+// false: it could not be had or pushed (logged).
+func (m *Manager) uploadGuestFix(i int, fx guestFixIO, p guestpatch.Profile) bool {
+	library := fx.library(p)
+	if library == "" {
+		return false
+	}
+	res := fx.adb(60*time.Second, "push", library, p.UploadPath)
+	if res.Code != 0 {
+		m.Log.Warnf("实例 %d %s没挂: 推送补丁库失败: %s", i, p.Name, tail(res.Out, 200))
+		return false
+	}
+	m.Log.Infof("实例 %d %s 第 2 步: 已推送 %s（sha256 %s）到 %s", i, p.Name, library, p.FixSHA256, p.UploadPath)
+	return true
+}
+
+// guestFixResult judges p's final status line of libfix.sh (out is the whole output, for a missing line). ok: p was
+// mounted in this run.
+func guestFixResult(i int, p guestpatch.Profile, status, out string) (r report, ok bool) {
+	kind, rest := libFixKind(status)
+	switch kind {
+	case "MOUNTED":
+		return report{false, fmt.Sprintf("实例 %d %s已挂上（sha256 %s）", i, p.Name, rest)}, true
+	case "ALREADY":
+		if rest == p.FixSHA256 {
+			return report{false, fmt.Sprintf("实例 %d %s本次开机已挂上（sha256 %s）", i, p.Name, rest)}, false
+		}
+		return report{true, fmt.Sprintf("实例 %d %s上已经挂着别的文件（sha256 %s），不是这次的补丁，没有动它", i, p.Lib, rest)}, false
+	case "IMAGE_PATCHED":
+		return report{false, fmt.Sprintf("实例 %d 镜像自带的%s已是补丁版，不用挂", i, p.Lib)}, false
+	case "ABSENT":
+		return report{false, fmt.Sprintf("实例 %d 镜像里没有%s（%s），不用挂", i, p.Lib, p.GuestPath)}, false
+	case "":
+		return report{true, fmt.Sprintf("实例 %d %s没挂: 客体脚本没有报这个库的结果: %s", i, p.Name,
+			orText(tail(out, 200), "无输出"))}, false
+	}
+	// SKIPPED image: not the expected image; SKIPPED patched: the guest cache was bad, removed, re-uploaded next time;
+	// FAILED: the mount did not take; READY / NEED_UPLOAD after the second run: another upload went wrong meanwhile
+	return report{true, fmt.Sprintf("实例 %d %s没挂: %s", i, p.Name, status)}, false
+}
+
+// libFixStatus maps each profile's target to its status in libfix.sh's output ("<target> <STATUS> [details]"; the
+// last line for a target wins). A target without a line is missing from the map.
+func libFixStatus(out string, profiles []guestpatch.Profile) map[string]string {
+	status := map[string]string{}
+	for _, line := range outputLines(out) {
+		line = strings.TrimSpace(line)
+		for _, p := range profiles {
+			if rest, ok := strings.CutPrefix(line, p.GuestPath+" "); ok {
+				status[p.GuestPath] = strings.TrimSpace(rest)
+			}
+		}
+	}
+	return status
+}
+
+// libFixKind splits a status: its first word when that is one of libfix.sh's, and what follows the first space (the
+// sha256 for MOUNTED / ALREADY). "" for anything else.
+func libFixKind(status string) (kind, rest string) {
+	word, rest, _ := strings.Cut(status, " ")
+	switch word {
+	case "NEED_UPLOAD", "READY", "ALREADY", "ABSENT", "IMAGE_PATCHED", "MOUNTED", "SKIPPED", "FAILED":
+		return word, rest
+	}
+	return "", ""
+}
+
+// guestFixCheckScript is the check of the libraries (no root, nothing changed), one line per target: "<target>
+// mounted" when something is mounted over it this boot (the test libfix.sh starts with), "<target> image <sha256>"
+// of the image's own, or "<target> absent".
+func guestFixCheckScript(profiles []guestpatch.Profile) string {
+	targets := make([]string, len(profiles))
+	for k, p := range profiles {
+		targets[k] = p.GuestPath
+	}
+	return `for t in ` + strings.Join(targets, " ") + `; do if grep -qF " $t " /proc/self/mountinfo; then echo "$t mounted"; ` +
+		`elif [ -e $t ]; then echo "$t image $(sha256sum $t | cut -d' ' -f1)"; else echo "$t absent"; fi; done`
+}
+
+// guestFixCheckReport judges p's line of guestFixCheckScript (line: what follows the target; out: the whole output,
+// for the message when it is unreadable). A warning only when the fix applies to this image and is missing: the
+// instance runs a whole boot without it then, and the warning says how to get it. Otherwise this boot's state is only
+// logged: an image whose library already is the patched one or has none, or an unexpected image (the start that
+// booted it reported that already).
+func guestFixCheckReport(i int, line, out string, p guestpatch.Profile) report {
+	switch sha, isImage := strings.CutPrefix(line, "image "); {
+	case line == "mounted":
+		return report{false, fmt.Sprintf("实例 %d %s: 本次开机已挂上", i, p.Name)}
+	case line == "absent":
+		return report{false, fmt.Sprintf("实例 %d 镜像里没有%s（%s），不用挂", i, p.Lib, p.GuestPath)}
+	case isImage && sha == p.FixSHA256:
+		return report{false, fmt.Sprintf("实例 %d 镜像自带的%s已是补丁版，不用挂", i, p.Lib)}
+	case isImage && sha == p.OrigSHA256:
+		return report{true, fmt.Sprintf("实例 %d %s这次开机没挂上：实例已在运行，挂它要重启 zygote（会结束正在运行的应用），"+
+			"这次不挂；要挂就先关掉这个实例再启动", i, p.Name)}
+	case isImage && len(sha) == 64:
+		return report{false, fmt.Sprintf("实例 %d %s不是预期的镜像版本（sha256 %s），不挂%s", i, p.Lib, sha, p.Name)}
+	}
+	return report{true, fmt.Sprintf("实例 %d 读不出%s这次开机挂没挂: %s", i, p.Name, orText(tail(out, 200), "无输出"))}
+}
+
+// guestFixCheckReports is guestFixCheckReport for every profile.
+func guestFixCheckReports(i int, out string, profiles []guestpatch.Profile) []report {
+	lines := libFixStatus(out, profiles)
+	reports := make([]report, len(profiles))
+	for k, p := range profiles {
+		reports[k] = guestFixCheckReport(i, lines[p.GuestPath], out, p)
+	}
+	return reports
+}
+
+// foregroundProbeScript prints, without root and without changing anything, the activity in front ("top: " and the
+// first topResumedActivity / mResumedActivity line of dumpsys) and the default HOME activity ("home: " and the last
+// line of resolve-activity --brief). Tagged lines: a dumpsys cut short by grep -m1 may add a "Broken pipe" line, and
+// adb errors come without the tags.
+const foregroundProbeScript = `echo "top: $(dumpsys activity activities | grep -m1 -E 'topResumedActivity|mResumedActivity')"; ` +
+	`echo "home: $(cmd package resolve-activity --brief -a android.intent.action.MAIN -c android.intent.category.HOME | tail -n1)"`
+
+// systemUIPackage in front (lock screen, notification shade) is no app in use.
+const systemUIPackage = "com.android.systemui"
+
+// guestFixMountAllowed decides from foregroundProbeScript's output whether an owed fix may be mounted now, i.e.
+// whether restarting zygote ends nothing anybody uses: the resumed activity belongs to the default HOME app, to
+// SystemUI, or there is none (topResumedActivity=null). A user app in front, or output that cannot be read, defers
+// it: a needless deferral costs one more start, a wrong guess ends a running game.
+//
+// A HOME that resolves to the "android" package is the resolver (no default home set); the chooser activities of that
+// package can also sit over a game, so it does not count as home. front names what is in front for the messages
+// ("无" for nothing, "" when unreadable).
+func guestFixMountAllowed(out string) (allowed bool, front string) {
+	top, home, topOK, homeOK := parseForegroundProbe(out)
+	if !topOK {
+		return false, ""
+	}
+	pkg, none, ok := resumedPackage(top)
+	switch {
+	case !ok:
+		return false, ""
+	case none:
+		return true, "无"
+	case pkg == systemUIPackage:
+		return true, pkg
+	}
+	if homeOK {
+		if h, ok := componentPackage(home); ok && h == pkg && h != "android" {
+			return true, pkg
+		}
+	}
+	return false, pkg
+}
+
+// parseForegroundProbe returns the values of foregroundProbeScript's tagged lines; ok=false for a tag that is missing.
+func parseForegroundProbe(out string) (top, home string, topOK, homeOK bool) {
+	for _, line := range outputLines(out) {
+		line = strings.TrimSpace(line)
+		if v, ok := strings.CutPrefix(line, "top:"); ok {
+			top, topOK = strings.TrimSpace(v), true
+		} else if v, ok := strings.CutPrefix(line, "home:"); ok {
+			home, homeOK = strings.TrimSpace(v), true
+		}
+	}
+	return top, home, topOK, homeOK
+}
+
+// resumedPackage reads a dumpsys line "topResumedActivity=ActivityRecord{1d5b2a5 u0 <pkg>/<activity> t5}" or
+// "mResumedActivity: ActivityRecord{...}". none: the record is null (nothing resumed). ok=false when the line is
+// neither (empty: dumpsys failed or printed something else).
+func resumedPackage(line string) (pkg string, none, ok bool) {
+	for _, mark := range []string{"topResumedActivity=", "mResumedActivity:"} {
+		k := strings.Index(line, mark)
+		if k < 0 {
+			continue
+		}
+		v := strings.TrimSpace(line[k+len(mark):])
+		if v == "null" {
+			return "", true, true
+		}
+		if p, ok := componentPackage(v); ok {
+			return p, false, true
+		}
+		return "", false, false
+	}
+	return "", false, false
+}
+
+// componentPackage is the package of the first "<pkg>/<class>" field of s (braces around it stripped); ok=false when
+// there is none or the part before the slash is no package name ("No activity found", an error text).
+func componentPackage(s string) (string, bool) {
+	for _, f := range strings.Fields(s) {
+		f = strings.Trim(f, "{}")
+		pkg, _, found := strings.Cut(f, "/")
+		if !found {
+			continue
+		}
+		return pkg, validPackageName(pkg)
+	}
+	return "", false
+}
+
+// validPackageName: letters, digits, '_' and '.', starting with a letter (Android package names).
+func validPackageName(s string) bool {
+	if s == "" {
+		return false
+	}
+	for k, r := range s {
+		switch {
+		case r >= 'a' && r <= 'z', r >= 'A' && r <= 'Z':
+		case k > 0 && (r >= '0' && r <= '9' || r == '_' || r == '.'):
+		default:
+			return false
+		}
+	}
+	return true
+}
+
+// guestFixDeferredReport judges guestFixCheckScript's output for owed fixes that were not mounted because the guest
+// is in use (b from owedMountGate). pending: one of them applies to this image and is missing, or that cannot be
+// read; one warning (guestFixDeferredMessage) then names those, and the setup marker stays. The others (mounted
+// already, patched image, no such library, unexpected image) are reported as guestFixCheckReport says.
+func guestFixDeferredReport(i int, out string, b mountBlocker, until, now time.Time, profiles []guestpatch.Profile) (pending bool,
+	reports []report) {
+	lines := libFixStatus(out, profiles)
+	var owed []guestpatch.Profile
+	unknown := false
+	for _, p := range profiles {
+		r := guestFixCheckReport(i, lines[p.GuestPath], out, p)
+		if !r.warn {
+			reports = append(reports, r)
+			continue
+		}
+		owed = append(owed, p)
+		if lines[p.GuestPath] != "image "+p.OrigSHA256 {
+			unknown = true
+		}
+	}
+	if len(owed) == 0 {
+		return false, reports
+	}
+	detail := b.detail
+	if unknown {
+		u := "这次开机挂没挂也读不出: " + orText(tail(out, 200), "无输出")
+		if detail == "" {
+			detail = u
+		} else {
+			detail += "；" + u
+		}
+	}
+	return true, append(reports, report{true, guestFixDeferredMessage(i, owed, b, detail, until, now)})
+}
+
+// guestFixDeferredMessage is the warning of owed fixes left out (b: why), with detail in brackets when not "". It
+// names the marker's deadline (until) as local time and that only the next boot mounts them after that: a start after
+// the deadline adopts the boot as an ordinary running instance and only checks the fixes.
+func guestFixDeferredMessage(i int, profiles []guestpatch.Profile, b mountBlocker, detail string, until, now time.Time) string {
+	var retry string
+	switch {
+	case until.IsZero():
+		retry = b.then + "再 start 一次，或下次开机自动挂"
+	case !now.Before(until):
+		retry = "这次开机接着做设置的期限（" + clockText(until, now) + "）已过，等下次开机自动挂"
+	default:
+		retry = b.then + "在 " + clockText(until, now) + " 前再 start 一次，过了这个时间就等下次开机自动挂"
+	}
+	names := make([]string, len(profiles))
+	for k, p := range profiles {
+		names[k] = p.Name
+	}
+	msg := fmt.Sprintf("实例 %d 的%s还没挂：现在%s，挂上要重启 zygote；%s", i, strings.Join(names, "、"), b.what, retry)
+	if detail != "" {
+		msg += "（" + detail + "）"
+	}
+	return msg
+}
+
+// patchedGuestLibrary is the host cache <root>\guest-patches\<p.CacheName>, made when missing or bad: pull the
+// guest's own library, check its hash, patch, check the result's hash (p.Patch), write it. "" when any step fails
+// (logged, nothing mounted). Host I/O errors (disk full, a virus scanner holding the file) are warnings too.
+//
+// Two instances (separate modavd processes) may build it at once: each writes its own temp file and renames it
+// over the cache; one that cannot rename takes the other's file when that has the right hash.
+func (m *Manager) patchedGuestLibrary(ctx context.Context, i int, p guestpatch.Profile) string {
+	dir := m.Root.GuestPatchDir()
+	library := filepath.Join(dir, p.CacheName)
+	ioFail := func(err error) string {
+		m.Log.Warnf("实例 %d %s没挂: 本机读写补丁库失败（%s）: %v", i, p.Name, library, err)
+		return ""
+	}
+
+	if data, err := os.ReadFile(library); err == nil {
+		digest := guestpatch.SHA256Hex(data)
+		if digest == p.FixSHA256 {
+			m.Log.Infof("实例 %d %s: 用本机缓存 %s", i, p.Name, library)
+			return library
+		}
+		m.Log.Warnf("本机缓存的%s补丁版哈希不对（%s），重新生成: %s", p.Lib, digest, library)
+	} else if !errors.Is(err, fs.ErrNotExist) {
+		return ioFail(err)
+	}
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		return ioFail(err)
+	}
+
+	original := filepath.Join(dir, fmt.Sprintf("%s-%d.orig.so", strings.TrimSuffix(path.Base(p.GuestPath), ".so"), i))
+	defer os.Remove(original)
+	res := m.ADB.Run(ctx, adb.RunOptions{Serial: m.Root.Ports().Serial(i), Timeout: 60 * time.Second, Reregister: true},
+		"pull", p.GuestPath, original)
+	if res.Code != 0 || !regularFile(original) {
+		m.Log.Warnf("实例 %d %s没挂: 从客体拉 %s 失败: %s", i, p.Name, p.GuestPath, tail(res.Out, 200))
+		return ""
+	}
+	data, err := os.ReadFile(original)
+	if err != nil {
+		return ioFail(err)
+	}
+	m.Log.Infof("实例 %d 从客体拉到%s原版（sha256 %s），本机生成补丁版", i, p.Lib, guestpatch.SHA256Hex(data))
+	patched, err := p.Patch(data)
+	if err != nil {
+		m.Log.Warnf("实例 %d %s没挂: %v", i, p.Name, err)
+		return ""
+	}
+	if err := writeFileReplace(library, patched, fmt.Sprintf("%d-%d", os.Getpid(), i)); err != nil {
+		if b, rerr := os.ReadFile(library); rerr == nil && guestpatch.SHA256Hex(b) == p.FixSHA256 {
+			// another start wrote the same file meanwhile (and may be pushing it right now)
+			return library
+		}
+		return ioFail(err)
+	}
+	m.Log.Infof("实例 %d 已在本机生成%s补丁版（sha256 %s）: %s", i, p.Lib, p.FixSHA256, library)
+	return library
+}
+
+// writeFileReplace writes path through <path>.<tag>.tmp and a rename over it, retried for up to 3 s while another
+// process has the target open (an adb push reading it). The temp file is removed on failure.
+func writeFileReplace(path string, data []byte, tag string) error {
+	tmp := path + "." + tag + ".tmp"
+	err := os.WriteFile(tmp, data, 0o644)
+	if err == nil {
+		err = root.ReplaceWithRetry(tmp, path)
+	}
+	if err != nil {
+		os.Remove(tmp)
+	}
+	return err
+}
+
+// waitFrameworkBack waits after the zygote restart until SystemUI runs as a new process, then 8 s more (launcher).
+func (m *Manager) waitFrameworkBack(ctx context.Context, g guestIO, uiBefore string, timeout time.Duration) bool {
+	deadline := time.Now().Add(timeout)
+	if !sleepOrDone(ctx, 2*time.Second) {
+		return false
+	}
+	for time.Now().Before(deadline) {
+		res := g.shell("pidof com.android.systemui", 10*time.Second)
+		// pidof exits 1 with no output while SystemUI is down; an adb error text is no new pid either
+		if ui := strings.TrimSpace(res.Out); res.Code == 0 && ui != "" && ui != uiBefore {
+			return sleepOrDone(ctx, 8*time.Second)
+		}
+		if !sleepOrDone(ctx, 2*time.Second) {
+			return false
+		}
+	}
+	return false
+}
diff --git a/internal/emu/guestfix_test.go b/internal/emu/guestfix_test.go
new file mode 100644
index 0000000..8d94a78
--- /dev/null
+++ b/internal/emu/guestfix_test.go
@@ -0,0 +1,669 @@
+//go:build windows
+
+package emu
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"modavd/internal/adb"
+	"modavd/internal/avd"
+	"modavd/internal/guestpatch"
+	"modavd/internal/logx"
+	"modavd/internal/ndkfix"
+	"modavd/internal/testutil"
+	"modavd/internal/vkfix"
+	"modavd/internal/win"
+)
+
+var (
+	gfVK  = guestpatch.Vulkan()
+	gfNDK = guestpatch.NDK()
+	gfAll = []guestpatch.Profile{gfVK, gfNDK}
+)
+
+// gfLine is p's status line of libfix.sh (or of the check script).
+func gfLine(p guestpatch.Profile, s string) string { return p.GuestPath + " " + s + "\r\n" }
+
+func TestLibFixKind(t *testing.T) {
+	fix := ndkfix.FixSHA256
+	cases := []struct {
+		status     string
+		kind, rest string
+	}{
+		{"MOUNTED " + fix, "MOUNTED", fix},
+		{"ALREADY " + fix, "ALREADY", fix},
+		{"ALREADY 1234abcd", "ALREADY", "1234abcd"},
+		{"IMAGE_PATCHED", "IMAGE_PATCHED", ""},
+		{"ABSENT", "ABSENT", ""},
+		{"NEED_UPLOAD", "NEED_UPLOAD", ""},
+		{"READY", "READY", ""},
+		{"SKIPPED image 0000", "SKIPPED", "image 0000"},
+		{"SKIPPED patched 1111", "SKIPPED", "patched 1111"},
+		{"FAILED chcon u:object_r:system_lib_file:s0 -> u:object_r:shell_data_file:s0", "FAILED",
+			"chcon u:object_r:system_lib_file:s0 -> u:object_r:shell_data_file:s0"},
+		{"", "", ""},
+		{"MOUNTEDX", "", ""},
+		{"/system/bin/sh: libfix.sh: not found", "", ""},
+	}
+	for _, c := range cases {
+		if kind, rest := libFixKind(c.status); kind != c.kind || rest != c.rest {
+			t.Errorf("libFixKind(%q) = %q %q; want %q %q", c.status, kind, rest, c.kind, c.rest)
+		}
+	}
+}
+
+// TestLibFixStatus: one status per target, adb noise and the script's last line ignored, CR stripped.
+func TestLibFixStatus(t *testing.T) {
+	out := "some noise\r\n" + gfLine(gfVK, "READY") + gfLine(gfNDK, "NEED_UPLOAD") + "UNCHANGED\r\n"
+	want := map[string]string{gfVK.GuestPath: "READY", gfNDK.GuestPath: "NEED_UPLOAD"}
+	if got := libFixStatus(out, gfAll); !reflect.DeepEqual(got, want) {
+		t.Errorf("libFixStatus = %v", got)
+	}
+	// a target not asked about is not read; a later line wins
+	out = gfLine(gfVK, "MOUNTED x") + gfLine(gfNDK, "READY") + gfLine(gfNDK, "MOUNTED y")
+	if got := libFixStatus(out, []guestpatch.Profile{gfNDK}); !reflect.DeepEqual(got, map[string]string{gfNDK.GuestPath: "MOUNTED y"}) {
+		t.Errorf("libFixStatus(ndk) = %v", got)
+	}
+}
+
+// TestLibFixMountCommand: the script's mount arguments, five per library in the order libfix.sh reads them.
+func TestLibFixMountCommand(t *testing.T) {
+	got := libFixMountCommand("/data/local/tmp/libfix.sh", []guestpatch.Profile{gfNDK})
+	want := "su 0 sh /data/local/tmp/libfix.sh mount /system/lib64/libndk_translation.so " +
+		"/data/local/tmp/libndk_translation.hintnop1.so /data/local/tmp/ndkfix-upload.so " + ndkfix.OrigSHA256 + " " +
+		ndkfix.FixSHA256
+	if got != want {
+		t.Errorf("command\n got %s\nwant %s", got, want)
+	}
+	if got := libFixMountCommand("r", gfAll); strings.Count(got, " ") != 4+2*5 {
+		t.Errorf("two libraries: %s", got)
+	}
+}
+
+// TestGuestFixCheckReport: an adopted instance warns only when a fix applies to its image and is not mounted.
+func TestGuestFixCheckReport(t *testing.T) {
+	cases := []struct {
+		p    guestpatch.Profile
+		line string
+		warn bool
+		has  string
+	}{
+		{gfVK, "mounted", false, "客体 Vulkan 驱动补丁: 本次开机已挂上"},
+		{gfNDK, "mounted", false, "ARM 转译层补丁: 本次开机已挂上"},
+		{gfNDK, "image " + ndkfix.FixSHA256, false, "镜像自带的ARM 转译层库已是补丁版"},
+		{gfVK, "image " + vkfix.OrigSHA256, true, "客体 Vulkan 驱动补丁这次开机没挂上：实例已在运行"},
+		{gfNDK, "image " + ndkfix.OrigSHA256, true, "要挂就先关掉这个实例再启动"},
+		{gfNDK, "image " + strings.Repeat("ab", 32), false, "ARM 转译层库不是预期的镜像版本"},
+		{gfNDK, "absent", false, "镜像里没有ARM 转译层库（/system/lib64/libndk_translation.so）"},
+		{gfNDK, "image ", true, "读不出"}, // sha256sum failed
+		{gfNDK, "", true, "读不出ARM 转译层补丁这次开机挂没挂"},
+	}
+	for _, c := range cases {
+		r := guestFixCheckReport(4, c.line, "error: device offline", c.p)
+		if r.warn != c.warn || !strings.HasPrefix(r.msg, "实例 4 ") || !strings.Contains(r.msg, c.has) {
+			t.Errorf("guestFixCheckReport(%s, %q) = %v %q", c.p.Name, c.line, r.warn, r.msg)
+		}
+	}
+	// adb failed: every library unreadable, the message carries adb's text
+	rs := guestFixCheckReports(4, "error: device offline\n", gfAll)
+	if len(rs) != 2 || !rs[0].warn || !rs[1].warn || !strings.Contains(rs[1].msg, "device offline") {
+		t.Errorf("adb failed: %v", rs)
+	}
+	// the check reads the same mount test as libfix.sh, covers every target and never needs root
+	s := guestFixCheckScript(gfAll)
+	if !strings.HasPrefix(s, "for t in "+vkfix.GuestPath+" "+ndkfix.GuestPath+"; do ") ||
+		!strings.Contains(s, `grep -qF " $t " /proc/self/mountinfo`) || strings.Contains(s, "su ") {
+		t.Errorf("check script = %s", s)
+	}
+}
+
+// TestGuestFixMountAllowed: an owed fix is mounted only when nothing anybody uses is in front: the default home app,
+// SystemUI, or no resumed activity at all. Everything else, unreadable output included, defers it.
+func TestGuestFixMountAllowed(t *testing.T) {
+	const (
+		homeLight = "home: de.jrpie.android.launcher/de.jrpie.android.launcher.ui.HomeActivity\r\n"
+		homePixel = "home: com.google.android.apps.nexuslauncher/com.android.launcher3.uioverrides.QuickstepLauncher\r\n"
+	)
+	cases := []struct {
+		name    string
+		out     string
+		allowed bool
+		front   string
+	}{
+		{"light launcher in front", "top:   topResumedActivity=ActivityRecord{1d5b2a5 u0 de.jrpie.android.launcher/.ui.HomeActivity t5}\r\n" +
+			homeLight, true, "de.jrpie.android.launcher"},
+		{"pixel launcher (recents) in front", "top: mResumedActivity: ActivityRecord{77 u0 com.google.android.apps.nexuslauncher/" +
+			"com.android.launcher3.uioverrides.QuickstepLauncher t2}\n" + homePixel, true, "com.google.android.apps.nexuslauncher"},
+		{"game in front", "top:     mResumedActivity: ActivityRecord{9f1 u0 com.miHoYo.hkrpg/com.mihoyo.combosdk.ComboSDKActivity t12}\r\n" +
+			homeLight, false, "com.miHoYo.hkrpg"},
+		{"settings in front", "top: topResumedActivity=ActivityRecord{3 u0 com.android.settings/.Settings t9}\n" + homeLight,
+			false, "com.android.settings"},
+		{"systemui in front", "top: topResumedActivity=ActivityRecord{4 u0 com.android.systemui/.SomeActivity t3}\n" + homeLight,
+			true, "com.android.systemui"},
+		{"nothing resumed", "top:   topResumedActivity=null\nhome: \n", true, "无"},
+		// grep -m1 ends dumpsys early: its "Broken pipe" comes on a line of its own
+		{"broken pipe noise", "Broken pipe\r\ntop:   topResumedActivity=ActivityRecord{1 u0 de.jrpie.android.launcher/.ui.HomeActivity t5}\r\n" +
+			"Broken pipe\r\n" + homeLight, true, "de.jrpie.android.launcher"},
+		// the home app in front but no default home known: cannot tell it is home
+		{"home unresolved", "top: topResumedActivity=ActivityRecord{1 u0 com.android.launcher3/.Launcher t1}\nhome: No activity found\n",
+			false, "com.android.launcher3"},
+		{"home tag missing", "top: topResumedActivity=ActivityRecord{1 u0 de.jrpie.android.launcher/.ui.HomeActivity t5}\n",
+			false, "de.jrpie.android.launcher"},
+		// no default home: the resolver; android's chooser activities can sit over a game, so it is no home screen
+		{"resolver as home", "top: topResumedActivity=ActivityRecord{2 u0 android/com.android.internal.app.ChooserActivity t8}\n" +
+			"home: android/com.android.internal.app.ResolverActivity\n", false, "android"},
+		{"dumpsys gave nothing", "top: \r\n" + homeLight, false, ""},
+		{"no component in the record", "top: topResumedActivity=ActivityRecord{1 u0 t1}\n" + homeLight, false, ""},
+		{"not a package name", "top: topResumedActivity=ActivityRecord{1 u0 9bad/.A t1}\n" + homeLight, false, ""},
+		{"adb failed", "error: device 'emulator-20030' not found\r\n", false, ""},
+		{"no output", "", false, ""},
+	}
+	for _, c := range cases {
+		allowed, front := guestFixMountAllowed(c.out)
+		if allowed != c.allowed || front != c.front {
+			t.Errorf("%s: guestFixMountAllowed = %v %q, want %v %q", c.name, allowed, front, c.allowed, c.front)
+		}
+	}
+}
+
+func TestComponentPackage(t *testing.T) {
+	cases := []struct {
+		in  string
+		pkg string
+		ok  bool
+	}{
+		{"com.android.launcher3/.Launcher", "com.android.launcher3", true},
+		{"ActivityRecord{c5a u0 com.x_y.Z9/.A t9}", "com.x_y.Z9", true},
+		{"{com.a/.B}", "com.a", true},
+		{"android/com.android.internal.app.ResolverActivity", "android", true},
+		{"No activity found", "", false},
+		{"9bad/.A", "9bad", false},
+		{"/.A", "", false},
+		{"", "", false},
+	}
+	for _, c := range cases {
+		if pkg, ok := componentPackage(c.in); pkg != c.pkg || ok != c.ok {
+			t.Errorf("componentPackage(%q) = %q %v, want %q %v", c.in, pkg, ok, c.pkg, c.ok)
+		}
+	}
+}
+
+func TestForegroundProbeScript(t *testing.T) {
+	for _, s := range []string{
+		`echo "top: $(dumpsys activity activities | grep -m1 -E 'topResumedActivity|mResumedActivity')"`,
+		`echo "home: $(cmd package resolve-activity --brief -a android.intent.action.MAIN -c android.intent.category.HOME | tail -n1)"`,
+	} {
+		if !strings.Contains(foregroundProbeScript, s) {
+			t.Errorf("probe lacks %s: %s", s, foregroundProbeScript)
+		}
+	}
+	// read-only, no root
+	if strings.Contains(foregroundProbeScript, "su ") {
+		t.Errorf("probe uses su: %s", foregroundProbeScript)
+	}
+}
+
+// TestGuestFixDeferredReport: owed fixes left out because the guest is in use stay owed only while the image needs
+// one and it is not mounted (or that cannot be read); one warning names those, what is in the way and the deadline.
+func TestGuestFixDeferredReport(t *testing.T) {
+	now := time.Date(2026, 10, 28, 18, 0, 0, 0, time.Local)
+	until := now.Add(25*time.Minute + 30*time.Second)
+	const (
+		both    = "实例 3 的客体 Vulkan 驱动补丁、ARM 转译层补丁还没挂："
+		front   = "现在有应用在前台，挂上要重启 zygote；关掉应用后在 18:25 前再 start 一次，过了这个时间就等下次开机自动挂"
+		install = "现在有安装正在进行，挂上要重启 zygote；等安装完在 18:25 前再 start 一次，过了这个时间就等下次开机自动挂"
+	)
+	orig := gfLine(gfVK, "image "+vkfix.OrigSHA256) + gfLine(gfNDK, "image "+ndkfix.OrigSHA256)
+	game := foregroundBlocker("com.miHoYo.hkrpg")
+	cases := []struct {
+		name    string
+		out     string
+		b       mountBlocker
+		until   time.Time
+		pending bool
+		warn    string   // the one warning, exact ("" none)
+		infos   []string // parts of the info lines, in order
+	}{
+		{"both missing, game in front", orig, game, until, true, both + front + "（前台: com.miHoYo.hkrpg）", nil},
+		{"both missing, front unreadable", orig, foregroundBlocker(""), until, true,
+			both + front + "（读不出前台是什么，按有应用在用处理）", nil},
+		// an instance an older modavd booted: Vulkan mounted, the translator not
+		{"translator missing", gfLine(gfVK, "mounted") + gfLine(gfNDK, "image "+ndkfix.OrigSHA256), game, until, true,
+			"实例 3 的ARM 转译层补丁还没挂：" + front + "（前台: com.miHoYo.hkrpg）", []string{"客体 Vulkan 驱动补丁: 本次开机已挂上"}},
+		{"check unreadable", "error: device offline\n", game, until, true,
+			both + front + "（前台: com.miHoYo.hkrpg；这次开机挂没挂也读不出: error: device offline）", nil},
+		{"check gave nothing", "", game, until, true, both + front + "（前台: com.miHoYo.hkrpg；这次开机挂没挂也读不出: 无输出）", nil},
+		{"missing, install running", orig, installBlocker(nil), until, true, both + install, nil},
+		{"install lock unreadable", orig, installBlocker(errors.New("拒绝访问。")), until, true,
+			both + install + "（安装锁读不了（拒绝访问。），按有安装正在进行处理）", nil},
+		{"deadline passed", orig, game, now.Add(-5 * time.Minute), true,
+			both + "现在有应用在前台，挂上要重启 zygote；这次开机接着做设置的期限（17:55）已过，等下次开机自动挂（前台: com.miHoYo.hkrpg）", nil},
+		{"deadline unknown", orig, game, time.Time{}, true,
+			both + "现在有应用在前台，挂上要重启 zygote；关掉应用后再 start 一次，或下次开机自动挂（前台: com.miHoYo.hkrpg）", nil},
+		{"both mounted already", gfLine(gfVK, "mounted") + gfLine(gfNDK, "mounted"), game, until, false, "",
+			[]string{"客体 Vulkan 驱动补丁: 本次开机已挂上", "ARM 转译层补丁: 本次开机已挂上"}},
+		{"patched or unexpected images", gfLine(gfVK, "image "+vkfix.FixSHA256) + gfLine(gfNDK, "image "+strings.Repeat("cd", 32)),
+			installBlocker(nil), until, false, "", []string{"已是补丁版", "不是预期的镜像版本"}},
+		{"no translator in the image", gfLine(gfVK, "mounted") + gfLine(gfNDK, "absent"), game, until, false, "",
+			[]string{"本次开机已挂上", "镜像里没有ARM 转译层库"}},
+	}
+	for _, c := range cases {
+		pending, reports := guestFixDeferredReport(3, c.out, c.b, c.until, now, gfAll)
+		var warns, infos []string
+		for _, r := range reports {
+			if r.warn {
+				warns = append(warns, r.msg)
+			} else {
+				infos = append(infos, r.msg)
+			}
+		}
+		if pending != c.pending {
+			t.Errorf("%s: pending %v", c.name, pending)
+		}
+		if c.warn == "" && len(warns) != 0 || c.warn != "" && (len(warns) != 1 || warns[0] != c.warn) {
+			t.Errorf("%s: warnings %q, want %q", c.name, warns, c.warn)
+		}
+		if len(infos) != len(c.infos) {
+			t.Errorf("%s: infos %q, want %q", c.name, infos, c.infos)
+			continue
+		}
+		for k, s := range c.infos {
+			if !strings.HasPrefix(infos[k], "实例 3 ") || !strings.Contains(infos[k], s) {
+				t.Errorf("%s: info %q lacks %q", c.name, infos[k], s)
+			}
+		}
+	}
+}
+
+// fakeGuest is a guest for mountGuestFixes: canned answers per command, every command recorded by a short name, the
+// libraries of every libfix.sh run, and for each run whether the guest lock was held meanwhile.
+type fakeGuest struct {
+	t        *testing.T
+	lock     string          // guestLockPath of the instance
+	probes   []string        // successive foregroundProbeScript outputs
+	fixes    []string        // successive libfix.sh outputs
+	check    string          // guestFixCheckScript output
+	pushFail map[string]bool // upload paths whose push fails
+	onPush   func()          // runs during each push of a patched library
+	commands []string
+	runs     [][]string // the targets of each libfix.sh run
+	pushes   []string   // the upload paths pushed to
+	locked   []bool
+}
+
+const fakeLibFixRemote = "/data/local/tmp/libfix.sh"
+
+func (f *fakeGuest) io() guestFixIO {
+	return guestFixIO{
+		guestIO: guestIO{shell: f.shell, adb: f.adb},
+		remote:  fakeLibFixRemote,
+		library: func(p guestpatch.Profile) string { return `D:\r\guest-patches\` + p.CacheName },
+		waitBack: func(string) bool {
+			f.commands = append(f.commands, "wait")
+			return true
+		},
+	}
+}
+
+func (f *fakeGuest) shell(command string, _ time.Duration) adb.Result {
+	switch {
+	case command == "pidof com.android.systemui":
+		f.commands = append(f.commands, "pidof")
+		return adb.Result{Out: "1234\r\n"}
+	case command == foregroundProbeScript:
+		f.commands = append(f.commands, "probe")
+		if len(f.probes) == 0 {
+			f.t.Error("probe asked for more often than expected")
+			return adb.Result{Out: ""}
+		}
+		out := f.probes[0]
+		f.probes = f.probes[1:]
+		return adb.Result{Out: out}
+	case command == guestFixCheckScript(gfAll):
+		f.commands = append(f.commands, "check")
+		return adb.Result{Out: f.check}
+	case strings.HasPrefix(command, "su 0 sh "+fakeLibFixRemote+" mount "):
+		f.commands = append(f.commands, "fix")
+		args := strings.Fields(strings.TrimPrefix(command, "su 0 sh "+fakeLibFixRemote+" mount "))
+		var targets []string
+		for len(args) >= 5 {
+			var p guestpatch.Profile
+			for _, q := range gfAll {
+				if q.GuestPath == args[0] {
+					p = q
+				}
+			}
+			if want := []string{p.GuestPath, p.CachePath, p.UploadPath, p.OrigSHA256, p.FixSHA256}; !reflect.DeepEqual(args[:5], want) {
+				f.t.Errorf("libfix.sh arguments %q, want %q", args[:5], want)
+			}
+			targets = append(targets, args[0])
+			args = args[5:]
+		}
+		if len(args) != 0 {
+			f.t.Errorf("libfix.sh arguments left over: %q", args)
+		}
+		f.runs = append(f.runs, targets)
+		// a second handle conflicts like another process does (win.TryLock): busy = somebody holds it
+		l, free, err := win.TryLock(f.lock)
+		if err != nil {
+			f.t.Fatal(err)
+		}
+		l.Unlock()
+		f.locked = append(f.locked, !free)
+		if len(f.fixes) == 0 {
+			f.t.Error("libfix.sh ran more often than expected")
+			return adb.Result{Out: "UNCHANGED"}
+		}
+		out := f.fixes[0]
+		f.fixes = f.fixes[1:]
+		return adb.Result{Out: out}
+	}
+	f.t.Errorf("unexpected command %q", command)
+	return adb.Result{Code: 1, Out: "unexpected command"}
+}
+
+func (f *fakeGuest) adb(_ time.Duration, args ...string) adb.Result {
+	if len(args) == 3 && args[0] == "push" {
+		for _, p := range gfAll {
+			if args[1] == `D:\r\guest-patches\`+p.CacheName && args[2] == p.UploadPath {
+				f.commands = append(f.commands, "push")
+				f.pushes = append(f.pushes, args[2])
+				if f.onPush != nil {
+					f.onPush()
+				}
+				if f.pushFail[args[2]] {
+					return adb.Result{Code: 1, Out: "adb: error: failed to copy: No space left on device"}
+				}
+				return adb.Result{Out: "1 file pushed"}
+			}
+		}
+	}
+	f.t.Errorf("unexpected adb %q", args)
+	return adb.Result{Code: 1, Out: "unexpected adb"}
+}
+
+// TestMountGuestFixes walks the mount against a fake guest. Both libraries go through one libfix.sh run and one
+// zygote restart; a library that needs an upload holds back the mount of all of them until the upload is there (one
+// push per library, one second run, still one restart). A launched boot mounts without a foreground question but
+// still under the guest lock (an install of another process defers it); an owed one passes owedMountGate before every
+// libfix.sh run that may mount (the guest lock, held over that run and freed right after it, then the foreground
+// probe), so a game launched or an install started while a patched library was being uploaded still defers the
+// zygote restart.
+func TestMountGuestFixes(t *testing.T) {
+	const (
+		gameFront = "top:     mResumedActivity: ActivityRecord{9f1 u0 com.miHoYo.hkrpg/.Game t12}\r\n" +
+			"home: de.jrpie.android.launcher/de.jrpie.android.launcher.ui.HomeActivity\r\n"
+		homeFront = "top:   topResumedActivity=ActivityRecord{1 u0 de.jrpie.android.launcher/.ui.HomeActivity t5}\r\n" +
+			"home: de.jrpie.android.launcher/de.jrpie.android.launcher.ui.HomeActivity\r\n"
+		both = "客体 Vulkan 驱动补丁、ARM 转译层补丁"
+	)
+	var (
+		vk, ndk     = gfVK.GuestPath, gfNDK.GuestPath
+		mountedVK   = gfLine(gfVK, "MOUNTED "+gfVK.FixSHA256)
+		mountedNDK  = gfLine(gfNDK, "MOUNTED "+gfNDK.FixSHA256)
+		mountedBoth = mountedVK + mountedNDK + "RESTARTED\r\n"
+		uploadNDK   = gfLine(gfVK, "READY") + gfLine(gfNDK, "NEED_UPLOAD") + "UNCHANGED\r\n"
+		uploadBoth  = gfLine(gfVK, "NEED_UPLOAD") + gfLine(gfNDK, "NEED_UPLOAD") + "UNCHANGED\r\n"
+		origBoth    = gfLine(gfVK, "image "+gfVK.OrigSHA256) + gfLine(gfNDK, "image "+gfNDK.OrigSHA256)
+		mountedOld  = gfLine(gfVK, "mounted") + gfLine(gfNDK, "mounted")
+		bothRuns    = []string{vk, ndk}
+	)
+	until := time.Now().Add(20 * time.Minute)
+	retry := "在 " + clockText(until, time.Now()) + " 前再 start 一次，过了这个时间就等下次开机自动挂"
+	cases := []struct {
+		name               string
+		owed               bool
+		installing         bool // an install holds the guest lock from the start
+		installDuringPush  bool // an install takes it while a library is uploaded
+		pushFail           []string
+		probes, fixes      []string
+		check              string
+		commands           []string
+		runs               [][]string
+		pushes             []string
+		locked             []bool
+		restarted, pending bool
+		level              logx.Level
+		has                []string
+	}{
+		{name: "launched, cached in the guest", fixes: []string{mountedBoth},
+			commands: []string{"pidof", "fix", "wait"}, runs: [][]string{bothRuns}, locked: []bool{true}, restarted: true,
+			level: logx.Info, has: []string{"客体库补丁已挂上（" + both + "），zygote 重启后系统界面已回来"}},
+		{name: "launched, both uploaded", fixes: []string{uploadBoth, mountedBoth},
+			commands: []string{"pidof", "fix", "push", "push", "fix", "wait"}, runs: [][]string{bothRuns, bothRuns},
+			pushes: []string{gfVK.UploadPath, gfNDK.UploadPath}, locked: []bool{true, true}, restarted: true,
+			level: logx.Info, has: []string{"第 3 步（挂载）"}},
+		{name: "launched, translator uploaded", fixes: []string{uploadNDK, mountedBoth},
+			commands: []string{"pidof", "fix", "push", "fix", "wait"}, runs: [][]string{bothRuns, bothRuns},
+			pushes: []string{gfNDK.UploadPath}, locked: []bool{true, true}, restarted: true,
+			level: logx.Info, has: []string{"ARM 转译层补丁已挂上（sha256 " + gfNDK.FixSHA256 + "）"}},
+		// the translator's push fails: the second run mounts the Vulkan driver alone
+		{name: "launched, translator push failed", pushFail: []string{gfNDK.UploadPath},
+			fixes: []string{uploadNDK, mountedVK + "RESTARTED\r\n"}, commands: []string{"pidof", "fix", "push", "fix", "wait"},
+			runs: [][]string{bothRuns, {vk}}, pushes: []string{gfNDK.UploadPath}, locked: []bool{true, true}, restarted: true,
+			level: logx.Warn, has: []string{"ARM 转译层补丁没挂: 推送补丁库失败: adb: error: failed to copy"}},
+		{name: "launched, every push failed", pushFail: []string{gfVK.UploadPath, gfNDK.UploadPath}, fixes: []string{uploadBoth},
+			commands: []string{"pidof", "fix", "push", "push"}, runs: [][]string{bothRuns},
+			pushes: []string{gfVK.UploadPath, gfNDK.UploadPath}, locked: []bool{true},
+			level: logx.Warn, has: []string{"客体 Vulkan 驱动补丁没挂: 推送补丁库失败"}},
+		// another image release: the translator is left alone, the Vulkan driver still mounted
+		{name: "launched, translator of another image",
+			fixes:    []string{mountedVK + gfLine(gfNDK, "SKIPPED image "+strings.Repeat("ab", 32)) + "RESTARTED\r\n"},
+			commands: []string{"pidof", "fix", "wait"}, runs: [][]string{bothRuns}, locked: []bool{true}, restarted: true,
+			level: logx.Warn, has: []string{"ARM 转译层补丁没挂: SKIPPED image abab"}},
+		{name: "launched, no translator in the image", fixes: []string{mountedVK + gfLine(gfNDK, "ABSENT") + "RESTARTED\r\n"},
+			commands: []string{"pidof", "fix", "wait"}, runs: [][]string{bothRuns}, locked: []bool{true}, restarted: true,
+			level: logx.Info, has: []string{"镜像里没有ARM 转译层库（/system/lib64/libndk_translation.so），不用挂"}},
+		{name: "launched, something else mounted", fixes: []string{gfLine(gfVK, "ALREADY "+gfVK.FixSHA256) +
+			gfLine(gfNDK, "ALREADY 1234") + "UNCHANGED\r\n"}, commands: []string{"pidof", "fix"}, runs: [][]string{bothRuns},
+			locked: []bool{true}, level: logx.Warn, has: []string{"ARM 转译层库上已经挂着别的文件（sha256 1234）"}},
+		{name: "launched, script printed nothing for the translator", fixes: []string{mountedVK + "RESTARTED\r\n"},
+			commands: []string{"pidof", "fix", "wait"}, runs: [][]string{bothRuns}, locked: []bool{true}, restarted: true,
+			level: logx.Warn, has: []string{"ARM 转译层补丁没挂: 客体脚本没有报这个库的结果"}},
+		// a launched boot asks no foreground question, but an install of another process defers the mount the same way
+		{name: "launched, install running", installing: true, check: origBoth,
+			commands: []string{"pidof", "check"}, pending: true,
+			level: logx.Warn, has: []string{"的" + both + "还没挂：现在有安装正在进行，挂上要重启 zygote；等安装完" + retry}},
+		{name: "owed, home in front, cached", owed: true, probes: []string{homeFront}, fixes: []string{mountedBoth},
+			commands: []string{"pidof", "probe", "fix", "wait"}, runs: [][]string{bothRuns}, locked: []bool{true}, restarted: true,
+			level: logx.Info, has: []string{"没有应用在用，也没有安装在进行，接着挂"}},
+		{name: "owed, game in front", owed: true, probes: []string{gameFront}, check: origBoth,
+			commands: []string{"pidof", "probe", "check"}, pending: true,
+			level: logx.Warn, has: []string{both + "还没挂：现在有应用在前台，挂上要重启 zygote；关掉应用后" + retry, "（前台: com.miHoYo.hkrpg）"}},
+		// the Vulkan driver of an older modavd's start is mounted, the translator is not: still owed
+		{name: "owed, game in front, translator missing", owed: true, probes: []string{gameFront},
+			check: gfLine(gfVK, "mounted") + gfLine(gfNDK, "image "+gfNDK.OrigSHA256), commands: []string{"pidof", "probe", "check"},
+			pending: true, level: logx.Warn, has: []string{"实例 3 的ARM 转译层补丁还没挂：现在有应用在前台"}},
+		{name: "owed, game in front, fixes mounted already", owed: true, probes: []string{gameFront}, check: mountedOld,
+			commands: []string{"pidof", "probe", "check"}, level: logx.Info, has: []string{"ARM 转译层补丁: 本次开机已挂上"}},
+		{name: "owed, install running", owed: true, installing: true, check: origBoth,
+			commands: []string{"pidof", "check"}, pending: true,
+			level: logx.Warn, has: []string{"现在有安装正在进行，挂上要重启 zygote；等安装完" + retry}},
+		{name: "owed, install running, fixes mounted already", owed: true, installing: true, check: mountedOld,
+			commands: []string{"pidof", "check"}, level: logx.Info, has: []string{"本次开机已挂上"}},
+		{name: "owed, upload, game launched meanwhile", owed: true, probes: []string{homeFront, gameFront},
+			fixes: []string{uploadNDK}, commands: []string{"pidof", "probe", "fix", "push", "probe"}, runs: [][]string{bothRuns},
+			pushes: []string{gfNDK.UploadPath}, locked: []bool{true}, pending: true,
+			level: logx.Warn, has: []string{both + "还没挂：现在有应用在前台，挂上要重启 zygote；关掉应用后" + retry, "（前台: com.miHoYo.hkrpg）"}},
+		{name: "owed, upload, still home", owed: true, probes: []string{homeFront, homeFront},
+			fixes: []string{uploadNDK, mountedBoth}, commands: []string{"pidof", "probe", "fix", "push", "probe", "fix", "wait"},
+			runs: [][]string{bothRuns, bothRuns}, locked: []bool{true, true}, restarted: true, level: logx.Info,
+			has: []string{"第 3 步（挂载）"}},
+		{name: "owed, upload, install started meanwhile", owed: true, installDuringPush: true, probes: []string{homeFront},
+			fixes: []string{uploadNDK}, commands: []string{"pidof", "probe", "fix", "push"}, runs: [][]string{bothRuns},
+			locked: []bool{true}, pending: true,
+			level: logx.Warn, has: []string{"现在有安装正在进行，挂上要重启 zygote；等安装完" + retry}},
+		{name: "owed, upload, mount failed", owed: true, probes: []string{homeFront, homeFront},
+			fixes:    []string{uploadBoth, gfLine(gfVK, "FAILED mount 0000") + gfLine(gfNDK, "FAILED mount 0000") + "UNCHANGED\r\n"},
+			commands: []string{"pidof", "probe", "fix", "push", "push", "probe", "fix"}, runs: [][]string{bothRuns, bothRuns},
+			locked: []bool{true, true}, level: logx.Warn, has: []string{"客体 Vulkan 驱动补丁没挂: FAILED mount 0000"}},
+	}
+	for _, c := range cases {
+		m := markerTestManager(t)
+		var lines []logLine
+		m.Log = logx.New(func(level logx.Level, msg string) { lines = append(lines, logLine{level, msg}) })
+		f := &fakeGuest{t: t, lock: m.guestLockPath(3), probes: c.probes, fixes: c.fixes, check: c.check,
+			pushFail: map[string]bool{}}
+		for _, p := range c.pushFail {
+			f.pushFail[p] = true
+		}
+		var install *win.FileLock
+		takeInstall := func() {
+			if install != nil {
+				return
+			}
+			l, ok, err := win.TryLock(m.guestLockPath(3))
+			if err != nil || !ok {
+				t.Fatalf("%s: install lock: %v %v", c.name, ok, err)
+			}
+			install = l
+		}
+		if c.installing {
+			takeInstall()
+		}
+		if c.installDuringPush {
+			f.onPush = takeInstall
+		}
+
+		restarted, pending := m.mountGuestFixes(context.Background(), 3, f.io(), gfAll, c.owed, until)
+		install.Unlock()
+
+		if restarted != c.restarted || pending != c.pending {
+			t.Errorf("%s: restarted %v pending %v", c.name, restarted, pending)
+		}
+		if !reflect.DeepEqual(f.commands, c.commands) {
+			t.Errorf("%s: commands %q, want %q", c.name, f.commands, c.commands)
+		}
+		if !reflect.DeepEqual(f.runs, c.runs) {
+			t.Errorf("%s: libfix.sh runs %q, want %q", c.name, f.runs, c.runs)
+		}
+		if c.pushes != nil && !reflect.DeepEqual(f.pushes, c.pushes) {
+			t.Errorf("%s: pushes %q, want %q", c.name, f.pushes, c.pushes)
+		}
+		if !reflect.DeepEqual(f.locked, c.locked) {
+			t.Errorf("%s: guest lock held during the runs %v, want %v", c.name, f.locked, c.locked)
+		}
+		if len(f.probes) != 0 || len(f.fixes) != 0 {
+			t.Errorf("%s: answers left over: probes %d, fixes %d", c.name, len(f.probes), len(f.fixes))
+		}
+		// whatever happened, the guest lock is free again
+		if l, ok, err := win.TryLock(m.guestLockPath(3)); err != nil || !ok {
+			t.Errorf("%s: guest lock still held after the mount: %v %v", c.name, ok, err)
+		} else {
+			l.Unlock()
+		}
+		var found bool
+		for _, l := range lines {
+			if l.level == c.level && strings.HasPrefix(l.msg, "实例 3 ") {
+				all := true
+				for _, s := range c.has {
+					all = all && strings.Contains(l.msg, s)
+				}
+				found = found || all
+			}
+			if l.level == logx.Warn && c.level != logx.Warn {
+				t.Errorf("%s: unexpected warning %q", c.name, l.msg)
+			}
+		}
+		if !found {
+			t.Errorf("%s: no %v line with %q in %v", c.name, c.level, c.has, lines)
+		}
+	}
+}
+
+// TestGuestLibFixes: the patches follow the instance's configured guest ABI; ARM64 and unknown or unreadable ABIs
+// get none (and say why).
+func TestGuestLibFixes(t *testing.T) {
+	m := markerTestManager(t)
+	write := func(i int, body string) {
+		p := avd.ConfigPath(m.Root, i)
+		if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(p, []byte(body), 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	write(1, "abi.type=x86_64\nhw.cpu.arch=x86_64\n")
+	write(2, "abi.type=arm64-v8a\nhw.cpu.arch=arm64\n")
+	write(3, "hw.cpu.arch=mips\nabi.type=mips\n")
+	ps, err := m.guestLibFixes(&avd.Instance{Index: 1, Config: mustIni("abi.type=x86_64\nhw.cpu.arch=x86_64\n")})
+	if err != nil || len(ps) != 2 || ps[0].GuestPath != vkfix.GuestPath || ps[1].GuestPath != ndkfix.GuestPath {
+		t.Errorf("x86_64: %v %v", ps, err)
+	}
+	if ps, err := m.guestLibFixes(&avd.Instance{Index: 2, Config: mustIni("abi.type=arm64-v8a\nhw.cpu.arch=arm64\n")}); ps != nil || err == nil || !strings.Contains(err.Error(), "没有 ARM 转译层") {
+		t.Errorf("arm64: %v %v", ps, err)
+	}
+	if ps, err := m.guestLibFixes(&avd.Instance{Index: 3, Config: mustIni("hw.cpu.arch=mips\nabi.type=mips\n")}); ps != nil || err == nil || !strings.Contains(err.Error(), `"mips"`) {
+		t.Errorf("mips: %v %v", ps, err)
+	}
+	if ps, err := m.guestLibFixes(&avd.Instance{Index: 4, Config: mustIni("hw.cpu.arch=x86_64\n")}); err != nil || len(ps) != 2 {
+		t.Errorf("missing abi.type defaults to x86_64: %v %v", ps, err)
+	}
+}
+
+func mustIni(body string) *avd.Ini {
+	cfg := avd.NewIni()
+	for _, line := range strings.Split(strings.TrimSpace(body), "\n") {
+		if k, v, ok := strings.Cut(line, "="); ok {
+			cfg.Set(k, v)
+		}
+	}
+	return cfg
+}
+
+func TestGuestFixConstants(t *testing.T) {
+	// the upload name is AUTO-MAS vulkanfix.sh's (u= there); the cache name is vkfix's (it has the template fix)
+	if gfVK.CachePath != "/data/local/tmp/libvulkan_enc.khrfix-bindlock2-dstpl1.so" ||
+		gfVK.UploadPath != "/data/local/tmp/vulkanfix-upload.so" || gfVK.GuestPath != "/vendor/lib64/libvulkan_enc.so" ||
+		gfVK.CacheName != "libvulkan_enc.khrfix-bindlock2-dstpl1.so" {
+		t.Errorf("vulkan profile changed: %+v", gfVK)
+	}
+	if gfNDK.CachePath != "/data/local/tmp/"+ndkfix.CacheName || gfNDK.GuestPath != "/system/lib64/libndk_translation.so" {
+		t.Errorf("translator profile: %+v", gfNDK)
+	}
+}
+
+func TestWriteFileReplace(t *testing.T) {
+	dir := testutil.TempDir(t)
+	path := filepath.Join(dir, ndkfix.CacheName)
+	if err := writeFileReplace(path, []byte("first"), "1-0"); err != nil {
+		t.Fatal(err)
+	}
+	if err := writeFileReplace(path, []byte("second"), "2-0"); err != nil {
+		t.Fatal(err)
+	}
+	if b, _ := os.ReadFile(path); string(b) != "second" {
+		t.Errorf("content = %q", b)
+	}
+	entries, _ := os.ReadDir(dir)
+	for _, e := range entries {
+		if strings.HasSuffix(e.Name(), ".tmp") {
+			t.Errorf("temp file left: %s", e.Name())
+		}
+	}
+
+	// the target held open without delete sharing (Go's own open): the rename keeps failing, the temp file goes
+	f, err := os.Open(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	err = writeFileReplace(path, []byte("third"), "3-0")
+	f.Close()
+	if err == nil {
+		t.Log("rename over an open file succeeded on this system")
+	}
+	entries, _ = os.ReadDir(dir)
+	for _, e := range entries {
+		if strings.HasSuffix(e.Name(), ".tmp") {
+			t.Errorf("temp file left after a failed rename: %s", e.Name())
+		}
+	}
+}
diff --git a/internal/emu/start.go b/internal/emu/start.go
index f9b0a2d..a00947e 100644
--- a/internal/emu/start.go
+++ b/internal/emu/start.go
@@ -68,8 +68,8 @@ var startFindQemu = (*Manager).findQemu
 // for a stop of the same instance to finish first (otherwise it would take an instance that is shutting down for a
 // running one). A guest that is powering off without a stop of ours (the window's ×, AUTO-MAS's own close) is waited
 // for the same way: its qemu has to exit first, then the instance boots again (see guestShuttingDown). Already
-// running: no launch; the boot wait and the per-boot steps run again, the Vulkan fix is only checked (mounting it
-// restarts zygote and would end the apps running on it). On cancel the emulator is left running: ending qemu without
+// running: no launch; the boot wait and the per-boot steps run again, the guest library fixes are only checked
+// (mounting them restarts zygote and would end the apps running on it). On cancel the emulator is left running: ending qemu without
 // a guest shutdown is a power cut.
 //
 // Unlike AUTO-MAS (one long-running process), a start here can end before its setup is done: an MCP call cancelled,
@@ -78,13 +78,13 @@ var startFindQemu = (*Manager).findQemu
 // deadline (setupMarkerWindow after qemu started: the launching start's own boot timeout counts) does the setup as on
 // a fresh boot, and the error of the interrupted start names that deadline. The guest may be in use by then all the
 // same (AUTO-MAS adopted it and launched a game, an MCP client went on with shell / install_apk, a CLI user pressed
-// Ctrl+C on a slow start --window and started playing), so that start mounts the Vulkan fix (a zygote restart, ending
-// every app) only while no app is in the foreground and no install holds the guest lock; otherwise it leaves the
+// Ctrl+C on a slow start --window and started playing), so that start mounts the guest library fixes (a zygote
+// restart, ending every app) only while no app is in the foreground and no install holds the guest lock; otherwise it leaves the
 // marker, warns and reports SetupPending.
 //
 // A start that finishes records the guest boot it set up and leaves a boot watch on its qemu (bootwatch.go): when
 // the guest reboots on its own (qemu stays), the watch runs this start again, and so does any start that finds the
-// recorded boot_id changed. The per-boot steps then run again and the Vulkan fix is owed as above.
+// recorded boot_id changed. The per-boot steps then run again and the guest library fixes are owed as above.
 func (m *Manager) Start(ctx context.Context, i int, opt StartOptions) (*StartResult, error) {
 	if err := requireWindows(); err != nil {
 		return nil, err
@@ -257,7 +257,7 @@ func (m *Manager) start(ctx context.Context, inst *avd.Instance, opt StartOption
 				if d := mk.deadline(p); !d.IsZero() {
 					why = "接着做设置的期限 " + clockText(d, now) + " 已过"
 				}
-				m.Log.Infof("实例 %d 的开机设置标记已过期（%s），按已在运行的实例处理，客体 Vulkan 驱动补丁等下次开机再挂", i, why)
+				m.Log.Infof("实例 %d 的开机设置标记已过期（%s），按已在运行的实例处理，客体库补丁等下次开机再挂", i, why)
 				m.removeSetupMarker(i)
 			default:
 				// absent, unreadable or naming another process (that boot is over): an ordinary adopt
@@ -366,7 +366,7 @@ func (m *Manager) start(ctx context.Context, inst *avd.Instance, opt StartOption
 		return nil, owed(err)
 	}
 	qemu, gone := qemuAfterSetup(qemu, now, found)
-	// The setup is over (done, or its boot is gone), unless the Vulkan fix was left out because an app was in the
+	// The setup is over (done, or its boot is gone), unless a guest library fix was left out because an app was in the
 	// foreground or an install was running: the marker then stays, so a start after that (before its deadline) still
 	// mounts it.
 	if gone || !ab.SetupPending {
@@ -377,7 +377,8 @@ func (m *Manager) start(ctx context.Context, inst *avd.Instance, opt StartOption
 			qemu.PID, orText(logTail(res.LogFile, 8), "日志见 "+m.Root.LogsDir()))
 	}
 	// Callers write to /sdcard right after start (10-31 measurements): it is not there yet at sys.boot_completed,
-	// takes another 1–3 s to accept a new file after it is mounted, and the zygote restart of the Vulkan fix takes it
+	// takes another 1–3 s to accept a new file after it is mounted, and the zygote restart of the guest library fixes
+	// takes it
 	// away again for about 7 s. Usually ready long before the setup is done, so this costs nothing then.
 	if !m.waitSDCard(ctx, i) && ctx.Err() == nil {
 		m.Log.Warnf("实例 %d 开机后 /sdcard 在 %.0f 秒内一直写不进文件；先返回，稍后再写", i, sdcardMountWait.Seconds())
@@ -563,19 +564,19 @@ func (m *Manager) waitShutdown(ctx context.Context, i int, p host.Process, prog
 }
 
 // setupAdvice is added to the error of a start that ended after launching qemu (or adopting an unfinished boot). It
-// names the marker's deadline (until; zero when unknown) as local time and the rules of the Vulkan fix's zygote
-// restart (owedMountGate), so nobody expects the next start to restart zygote under a running game or install, or to
+// names the marker's deadline (until; zero when unknown) as local time and the rules of the guest library fixes'
+// zygote restart (owedMountGate), so nobody expects the next start to restart zygote under a running game or install, or to
 // still finish the setup after the deadline (that start adopts the boot as an ordinary running instance).
 func setupAdvice(until, now time.Time) string {
-	const fix = "这个补丁要重启 zygote，只在前台没有应用、也没有安装正在进行时才挂（不然就留到之后再启动一次，或下次开机）"
+	const fix = "挂这些补丁要重启 zygote，只在前台没有应用、也没有安装正在进行时才挂（不然就留到之后再启动一次，或下次开机）"
 	switch {
 	case until.IsZero():
-		return "模拟器没有关：再启动一次这个实例，就会接着做完这次开机后的设置，其中包括客体 Vulkan 驱动补丁；" + fix
+		return "模拟器没有关：再启动一次这个实例，就会接着做完这次开机后的设置，其中包括客体库补丁；" + fix
 	case !now.Before(until):
-		return "模拟器没有关；这次开机接着做设置的期限（" + clockText(until, now) + "）已过，客体 Vulkan 驱动补丁等下次开机再挂"
+		return "模拟器没有关；这次开机接着做设置的期限（" + clockText(until, now) + "）已过，客体库补丁等下次开机再挂"
 	}
 	return "模拟器没有关：在 " + clockText(until, now) + " 前再启动一次这个实例，就会接着做完这次开机后的设置，" +
-		"过了这个时间客体 Vulkan 驱动补丁就等下次开机再挂；" + fix
+		"过了这个时间客体库补丁就等下次开机再挂；" + fix
 }
 
 // clockText is t as local time for the messages: "15:04" on now's day, else with the date ("10 月 29 日 00:05"; a
@@ -705,13 +706,13 @@ func (m *Manager) writeSetupMarker(i int, s setupMarker) {
 		err = writeFileReplace(m.setupMarkerPath(i), b, strconv.Itoa(os.Getpid()))
 	}
 	if err != nil {
-		m.Log.Warnf("实例 %d 记不下「这次开机后的设置还没做完」（%v）：这次启动要是被打断，再启动一次补不上客体 Vulkan 驱动补丁", i, err)
+		m.Log.Warnf("实例 %d 记不下「这次开机后的设置还没做完」（%v）：这次启动要是被打断，再启动一次补不上客体库补丁", i, err)
 	}
 }
 
 // removeSetupMarker deletes the marker of instance i. A marker left behind after a finished setup would make the
-// next start of this boot run the one-time parts again (harmless while the Vulkan fix is mounted: the script finds
-// the mount; otherwise only with no app in the foreground, no install running and before its deadline), so a failure
+// next start of this boot run the one-time parts again (harmless while the guest library fixes are mounted: the
+// script finds the mounts; otherwise only with no app in the foreground, no install running and before its deadline), so a failure
 // is a warning.
 func (m *Manager) removeSetupMarker(i int) {
 	path := m.setupMarkerPath(i)
diff --git a/internal/emu/start_test.go b/internal/emu/start_test.go
index d7d5d10..886f169 100644
--- a/internal/emu/start_test.go
+++ b/internal/emu/start_test.go
@@ -318,7 +318,7 @@ func TestWithSetupAdvice(t *testing.T) {
 // no install.
 func TestSetupAdvice(t *testing.T) {
 	now := time.Date(2026, 10, 28, 18, 0, 0, 0, time.Local)
-	const rules = "这个补丁要重启 zygote，只在前台没有应用、也没有安装正在进行时才挂"
+	const rules = "挂这些补丁要重启 zygote，只在前台没有应用、也没有安装正在进行时才挂"
 	cases := []struct {
 		name  string
 		until time.Time
@@ -326,11 +326,11 @@ func TestSetupAdvice(t *testing.T) {
 		not   []string
 	}{
 		{"default timeout", now.Add(12 * time.Minute), []string{"模拟器没有关：在 18:12 前再启动一次这个实例，就会接着做完这次开机后的设置",
-			"过了这个时间客体 Vulkan 驱动补丁就等下次开机再挂", rules}, []string{"15 分钟"}},
+			"过了这个时间客体库补丁就等下次开机再挂", rules}, []string{"15 分钟"}},
 		// a start with timeout_s 1800 that timed out: qemu start + 30 + 10 min
 		{"30 min timeout", now.Add(10*time.Minute + 30*time.Second), []string{"在 18:10 前再启动一次这个实例", rules}, nil},
 		{"past midnight", time.Date(2026, 10, 29, 0, 20, 0, 0, time.Local), []string{"在 10 月 29 日 00:20 前再启动一次这个实例"}, nil},
-		{"deadline passed", now.Add(-time.Minute), []string{"模拟器没有关；这次开机接着做设置的期限（17:59）已过，客体 Vulkan 驱动补丁等下次开机再挂"},
+		{"deadline passed", now.Add(-time.Minute), []string{"模拟器没有关；这次开机接着做设置的期限（17:59）已过，客体库补丁等下次开机再挂"},
 			[]string{"前再启动一次"}},
 		{"deadline unknown", time.Time{}, []string{"再启动一次这个实例，就会接着做完这次开机后的设置", rules}, []string{"前再启动一次"}},
 	}
diff --git a/internal/emu/types.go b/internal/emu/types.go
index bd26fa0..51888cb 100644
--- a/internal/emu/types.go
+++ b/internal/emu/types.go
@@ -224,10 +224,11 @@ type StartResult struct {
 	FirstBoot    bool    `json:"first_boot"`    // the one-time setup ran in this call
 	LogFile      string  `json:"log_file"`
 	LogcatFile   string  `json:"logcat_file"`
-	// ZygoteRestarted: the guest Vulkan fix was mounted, which restarts zygote (all apps start over).
+	// ZygoteRestarted: guest library fixes (Vulkan driver, ARM translation layer) were mounted, which restarts zygote
+	// (all apps start over).
 	ZygoteRestarted bool `json:"zygote_restarted"`
-	// SetupPending: this boot's one-time setup (the Vulkan fix mount) is still owed: an app was in the foreground or a
-	// guest job ran, and mounting restarts zygote. A later start of the same boot (before the marker expires) finishes
+	// SetupPending: this boot's one-time setup (mounting the guest library fixes) is still owed: an app was in the
+	// foreground or a guest job ran, and mounting restarts zygote. A later start of the same boot (before the marker expires) finishes
 	// it; otherwise the next boot does.
 	SetupPending bool     `json:"setup_pending"`
 	Warnings     []string `json:"warnings"` // never null; setup steps that failed (none of them stop the boot)
diff --git a/internal/emu/vulkanfix.go b/internal/emu/vulkanfix.go
deleted file mode 100644
index 2de1fa5..0000000
--- a/internal/emu/vulkanfix.go
+++ /dev/null
@@ -1,533 +0,0 @@
-package emu
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"strings"
-	"time"
-
-	"modavd/internal/adb"
-	"modavd/internal/avd"
-	"modavd/internal/guest"
-	"modavd/internal/host"
-	"modavd/internal/root"
-	"modavd/internal/vkfix"
-)
-
-const (
-	vulkanFixScriptTimeout = 60 * time.Second
-	frameworkBackTimeout   = 120 * time.Second
-)
-
-// guestVulkanProfile uses the instance's configured ABI, never the host OS.
-// Do not guess when a config is unreadable or belongs to an unsupported guest.
-func (m *Manager) guestVulkanProfile(i int) (vkfix.Profile, error) {
-	cfg, err := avd.ReadIni(avd.ConfigPath(m.Root, i))
-	if err != nil {
-		return vkfix.Profile{}, fmt.Errorf("读取实例客体架构: %w", err)
-	}
-	abi := cfg.Value("abi.type")
-	profile, supported := vkfix.ForABI(abi)
-	if !supported {
-		if abi == "arm64-v8a" {
-			return vkfix.Profile{}, fmt.Errorf("ARM64 API35 Vulkan 补丁尚未验收，保留镜像原库；不套用 API34 补丁，也不挂载或重启 zygote")
-		}
-		return vkfix.Profile{}, fmt.Errorf("客体架构 %q 没有适用的 Vulkan 补丁", abi)
-	}
-	return profile, nil
-}
-
-// ensureVulkanFix bind-mounts the patched guest Vulkan encoder made on this host over /vendor/lib64/libvulkan_enc.so
-// and restarts zygote (AUTO-MAS _ensure_vulkan_fix; launcher -VulkanFix), for verified API34 x86_64 guests (user
-// 10-16). The patch (internal/vkfix) fixes Star Rail's descriptor templates (khrfix) and Endfield's unlocked
-// vkBindImageMemory lookups (bindlock); games that use neither path are unaffected. ARM64 API35 keeps its original
-// libraries until those separate Vulkan workloads have been validated; GLES3.1 capability does not prove either fix.
-//
-//   - vulkanfix.sh first checks whether this boot already has it mounted (nothing to do then), then the image
-//     library's hash against the configured guest ABI's profile; the patched copy is cached in the guest's
-//     /data/local/tmp, so the next boot mounts it without an upload.
-//   - Without a guest cache the host copy in <root>\guest-patches is pushed; without that, the guest's own library
-//     is pulled and patched here (patchedVulkanLibrary). The patched file is never shipped.
-//   - An instance that was already running (setupAdopted) is only checked: the zygote restart would end the game. A
-//     missing fix is a warning then (it reaches StartResult.Warnings), since that whole boot runs without it.
-//   - A boot whose setup an earlier start left unfinished (setupOwed) may have been put to use since: AUTO-MAS
-//     launched a game on it, an MCP client went on with it (install_apk among others), a user plays in the window.
-//     Each vulkanfix.sh run that may mount it first passes owedMountGate (no install holds the guest lock, and
-//     vulkanFixMountAllowed finds the guest unused: home screen, SystemUI or nothing in front); otherwise it is not
-//     mounted and, when the fix is still missing, pending=true: the setup marker stays and the result says
-//     SetupPending, so a start after the app is closed or the install is done (before until, the marker's deadline)
-//     mounts it, or the next boot does.
-//
-// Failures are only logged. Returns whether zygote was restarted, and whether the fix is still owed.
-func (m *Manager) ensureVulkanFix(ctx context.Context, i int, mode bootSetup, until time.Time) (restarted, pending bool) {
-	profile, err := m.guestVulkanProfile(i)
-	if err != nil {
-		m.Log.Warnf("实例 %d 客体 Vulkan 驱动补丁未执行: %v", i, err)
-		return false, false
-	}
-	if mode == setupAdopted {
-		res := m.shell(ctx, i, vulkanFixCheckScript, 0)
-		if warn, msg := vulkanFixCheckReport(i, res.Out, profile); warn {
-			m.Log.Warnf("%s", msg)
-		} else {
-			m.Log.Infof("%s", msg)
-		}
-		return false, false
-	}
-	remote, ok := m.pushGuestScript(ctx, i, guest.VulkanFix)
-	if !ok {
-		m.Log.Warnf("实例 %d 客体 Vulkan 驱动补丁没挂: 推送客体脚本失败", i)
-		return false, false
-	}
-	g := m.guestIO(ctx, i)
-	return m.mountVulkanFix(ctx, i, vulkanFixIO{
-		guestIO: g,
-		remote:  remote,
-		library: func() string { return m.patchedVulkanLibrary(ctx, i, profile) },
-		waitBack: func(uiBefore string) bool {
-			return m.waitFrameworkBack(ctx, g, uiBefore, frameworkBackTimeout)
-		},
-	}, profile, mode == setupOwed, until)
-}
-
-// vulkanFixIO is what mountVulkanFix works through: the instance's adb in Manager, a fake guest in tests.
-type vulkanFixIO struct {
-	guestIO
-	remote   string                     // vulkanfix.sh in the guest (pushed already)
-	library  func() string              // the host's patched library (patchedVulkanLibrary); "" when it cannot be had
-	waitBack func(uiBefore string) bool // after the zygote restart (waitFrameworkBack)
-}
-
-// mountBlocker is why an owed Vulkan fix is not mounted now, for the messages: what is in the way ("有应用在前台"),
-// what to do before the next start ("关掉应用后") and details ("" none).
-type mountBlocker struct {
-	what, then, detail string
-}
-
-// foregroundBlocker: vulkanFixMountAllowed refused (front as it returned it, "" when unreadable).
-func foregroundBlocker(front string) mountBlocker {
-	b := mountBlocker{what: "有应用在前台", then: "关掉应用后", detail: "前台: " + front}
-	if front == "" {
-		b.detail = "读不出前台是什么，按有应用在用处理"
-	}
-	return b
-}
-
-// installBlocker: the guest lock is held (err == nil) or cannot be taken for another reason, which counts the same
-// (a needless deferral costs one more start, a wrong guess breaks an install).
-func installBlocker(err error) mountBlocker {
-	b := mountBlocker{what: "有安装正在进行", then: "等安装完"}
-	if err != nil {
-		b.detail = fmt.Sprintf("安装锁读不了（%v），按有安装正在进行处理", err)
-	}
-	return b
-}
-
-// owedMountGate is passed right before each vulkanfix.sh run that may mount an owed fix (and so restart zygote, which
-// ends every app and breaks an install that is running):
-//   - the guest lock (guestLockPath), which InstallAPK holds while it installs: taken with TryLock, never waited
-//     for (an install of a 3 GB game takes minutes, a start should not);
-//   - then the foreground rule (vulkanFixMountAllowed), read again at every call: the patched library may have taken
-//     tens of seconds to make and upload since the last one, and a game may have been launched meanwhile.
-//
-// ok: both allow it, and release frees the lock right after that run returns: the restart has been triggered by
-// then, and an install started after it only meets a framework that is coming back (what InstallAPK's own boot check
-// and adb's errors report). Otherwise b says what is in the way and nothing is held.
-func (m *Manager) owedMountGate(i int, g guestIO) (release func(), b mountBlocker, ok bool) {
-	l, free, err := host.TryLock(m.guestLockPath(i))
-	if err != nil || !free {
-		return nil, installBlocker(err), false
-	}
-	probe := g.shell(foregroundProbeScript, 0)
-	allowed, front := vulkanFixMountAllowed(probe.Out)
-	if !allowed {
-		l.Unlock()
-		m.Log.Debugf("实例 %d 前台检查: %s", i, orText(tail(joinNonEmptyLines(probe.Out, " | "), 300), "无输出"))
-		return nil, foregroundBlocker(front), false
-	}
-	m.Log.Infof("实例 %d 这次开机的客体 Vulkan 驱动补丁还没做，前台是 %s、没有应用在用，也没有安装在进行，接着挂（会重启 zygote）",
-		i, front)
-	return l.Unlock, mountBlocker{}, true
-}
-
-// mountVulkanFix is the mounting part of ensureVulkanFix (a launched boot, or an owed one, owed=true: every run that
-// may mount passes owedMountGate first; until is the marker's deadline for the messages). Returns whether zygote was
-// restarted and whether an owed fix is still owed (deferred while the guest is in use).
-func (m *Manager) mountVulkanFix(ctx context.Context, i int, fx vulkanFixIO, profile vkfix.Profile, owed bool, until time.Time) (restarted,
-	pending bool) {
-	runFix := func() string {
-		res := fx.shell("su 0 sh "+fx.remote+" "+profile.OrigSHA256+" "+profile.FixSHA256, vulkanFixScriptTimeout)
-		return lastNonEmptyLine(res.Out)
-	}
-	// gatedFix is one vulkanfix.sh run, for an owed fix only once owedMountGate allows it, with the guest lock held
-	// over the run. ok=false: deferred (logged here) and nothing ran.
-	gatedFix := func(first bool) (status string, ok, pending bool) {
-		var release func()
-		var b mountBlocker
-		allowed := false
-		if owed {
-			release, b, allowed = m.owedMountGate(i, fx.guestIO)
-		} else {
-			// A launched boot has no app of ours in front yet, but an install_apk of another modavd process may already
-			// run (sys.boot_completed is 1 by now): the guest lock alone decides, the same way.
-			l, free, err := host.TryLock(m.guestLockPath(i))
-			if err == nil && free {
-				release, allowed = l.Unlock, true
-			} else {
-				b = installBlocker(err)
-			}
-		}
-		if allowed {
-			defer release()
-			return runFix(), true, false
-		}
-		if !first {
-			// the first run said NEED_UPLOAD: the image wants the fix and it is not mounted. The upload stays in the
-			// guest, so the start that mounts it does not upload again (vulkanfix.sh takes it into its cache).
-			m.Log.Warnf("%s", vulkanFixDeferredMessage(i, b, b.detail, until, time.Now()))
-			return "", false, true
-		}
-		res := fx.shell(vulkanFixCheckScript, 0)
-		pending, msg := vulkanFixDeferredReport(i, res.Out, b, until, time.Now(), profile)
-		if pending {
-			m.Log.Warnf("%s", msg)
-		} else {
-			m.Log.Infof("%s", msg)
-		}
-		return "", false, pending
-	}
-
-	uiBefore := strings.TrimSpace(fx.shell("pidof com.android.systemui", 0).Out)
-	status, ok, pending := gatedFix(true)
-	if !ok {
-		return false, pending
-	}
-	m.Log.Infof("实例 %d 客体 Vulkan 驱动补丁 第 1 步（客体检查）: %s", i, orText(status, "无输出"))
-	if kind, _ := vulkanFixStatus(status); kind == "NEED_UPLOAD" {
-		library := fx.library()
-		if library == "" {
-			return false, false
-		}
-		res := fx.adb(60*time.Second, "push", library, vkfix.UploadPath)
-		if res.Code != 0 {
-			m.Log.Warnf("实例 %d 客体 Vulkan 驱动补丁没挂: 推送补丁库失败: %s", i, tail(res.Out, 200))
-			return false, false
-		}
-		m.Log.Infof("实例 %d 客体 Vulkan 驱动补丁 第 2 步: 已推送 %s（sha256 %s）到 %s", i, library, profile.FixSHA256,
-			vkfix.UploadPath)
-		if status, ok, pending = gatedFix(false); !ok {
-			return false, pending
-		}
-		m.Log.Infof("实例 %d 客体 Vulkan 驱动补丁 第 3 步（挂载）: %s", i, orText(status, "无输出"))
-	}
-
-	kind, sha := vulkanFixStatus(status)
-	switch kind {
-	case "ALREADY":
-		if sha == profile.FixSHA256 {
-			m.Log.Infof("实例 %d 客体 Vulkan 驱动补丁本次开机已挂上（sha256 %s）", i, sha)
-		} else {
-			m.Log.Warnf("实例 %d 客体驱动库上已经挂着别的文件（sha256 %s），不是这次的补丁，没有动它", i, sha)
-		}
-		return false, false
-	case "VENDOR_PATCHED":
-		m.Log.Infof("实例 %d 镜像自带的客体驱动库已是补丁版，不用挂", i)
-		return false, false
-	case "MOUNTED":
-	default:
-		// SKIPPED image: not the expected image; SKIPPED patched: the guest cache was bad, removed, re-uploaded
-		// next time; FAILED: the mount did not take
-		m.Log.Warnf("实例 %d 客体 Vulkan 驱动补丁没挂: %s", i, orText(status, "客体脚本无输出"))
-		return false, false
-	}
-
-	started := time.Now()
-	back := fx.waitBack(uiBefore)
-	if ctx.Err() != nil {
-		return true, false // canceled while waiting: zygote did restart, but nothing is known about the framework
-	}
-	how := "超时未回来"
-	if back {
-		how = "已回来"
-	}
-	m.Log.Infof("实例 %d 客体 Vulkan 驱动补丁已挂上（sha256 %s），zygote 重启后系统界面%s（%.0f 秒）", i, sha, how,
-		time.Since(started).Seconds())
-	return true, false
-}
-
-// vulkanFixCheckScript is the check of an adopted instance (no root, nothing changed): "mounted" when something is
-// mounted over the library this boot (the test vulkanfix.sh starts with), else "image <sha256>" of the image's own.
-const vulkanFixCheckScript = `if grep -q ' ` + vkfix.GuestPath + ` ' /proc/self/mountinfo; then echo mounted;` +
-	` else echo "image $(sha256sum ` + vkfix.GuestPath + ` | cut -d' ' -f1)"; fi`
-
-// vulkanFixCheckReport judges vulkanFixCheckScript's output. A warning only when the fix applies to this image and is
-// missing: the instance runs a whole boot without it then (Star Rail's descriptor templates, Endfield's
-// vkBindImageMemory), and the warning says how to get it. Otherwise this boot's state is only logged: an image whose
-// library already is the patched one, or an unexpected image (the start that booted it reported that already).
-func vulkanFixCheckReport(i int, out string, profile vkfix.Profile) (warn bool, msg string) {
-	line := lastNonEmptyLine(out)
-	switch sha, isImage := strings.CutPrefix(line, "image "); {
-	case line == "mounted":
-		return false, fmt.Sprintf("实例 %d 客体 Vulkan 驱动补丁: 本次开机已挂上", i)
-	case isImage && sha == profile.FixSHA256:
-		return false, fmt.Sprintf("实例 %d 镜像自带的客体驱动库已是补丁版，不用挂", i)
-	case isImage && sha == profile.OrigSHA256:
-		return true, fmt.Sprintf("实例 %d 客体 Vulkan 驱动补丁这次开机没挂上：实例已在运行，挂它要重启 zygote（会结束正在运行的应用），"+
-			"这次不挂；要挂就先关掉这个实例再启动", i)
-	case isImage && len(sha) == 64:
-		return false, fmt.Sprintf("实例 %d 客体驱动库不是预期的镜像版本（sha256 %s），不挂 Vulkan 驱动补丁", i, sha)
-	}
-	return true, fmt.Sprintf("实例 %d 读不出客体 Vulkan 驱动补丁这次开机挂没挂: %s", i, orText(tail(out, 200), "无输出"))
-}
-
-// foregroundProbeScript prints, without root and without changing anything, the activity in front ("top: " and the
-// first topResumedActivity / mResumedActivity line of dumpsys) and the default HOME activity ("home: " and the last
-// line of resolve-activity --brief). Tagged lines: a dumpsys cut short by grep -m1 may add a "Broken pipe" line, and
-// adb errors come without the tags.
-const foregroundProbeScript = `echo "top: $(dumpsys activity activities | grep -m1 -E 'topResumedActivity|mResumedActivity')"; ` +
-	`echo "home: $(cmd package resolve-activity --brief -a android.intent.action.MAIN -c android.intent.category.HOME | tail -n1)"`
-
-// systemUIPackage in front (lock screen, notification shade) is no app in use.
-const systemUIPackage = "com.android.systemui"
-
-// vulkanFixMountAllowed decides from foregroundProbeScript's output whether an owed Vulkan fix may be mounted now,
-// i.e. whether restarting zygote ends nothing anybody uses: the resumed activity belongs to the default HOME app, to
-// SystemUI, or there is none (topResumedActivity=null). A user app in front, or output that cannot be read, defers
-// it: a needless deferral costs one more start, a wrong guess ends a running game.
-//
-// A HOME that resolves to the "android" package is the resolver (no default home set); the chooser activities of that
-// package can also sit over a game, so it does not count as home. front names what is in front for the messages
-// ("无" for nothing, "" when unreadable).
-func vulkanFixMountAllowed(out string) (allowed bool, front string) {
-	top, home, topOK, homeOK := parseForegroundProbe(out)
-	if !topOK {
-		return false, ""
-	}
-	pkg, none, ok := resumedPackage(top)
-	switch {
-	case !ok:
-		return false, ""
-	case none:
-		return true, "无"
-	case pkg == systemUIPackage:
-		return true, pkg
-	}
-	if homeOK {
-		if h, ok := componentPackage(home); ok && h == pkg && h != "android" {
-			return true, pkg
-		}
-	}
-	return false, pkg
-}
-
-// parseForegroundProbe returns the values of foregroundProbeScript's tagged lines; ok=false for a tag that is missing.
-func parseForegroundProbe(out string) (top, home string, topOK, homeOK bool) {
-	for _, line := range outputLines(out) {
-		line = strings.TrimSpace(line)
-		if v, ok := strings.CutPrefix(line, "top:"); ok {
-			top, topOK = strings.TrimSpace(v), true
-		} else if v, ok := strings.CutPrefix(line, "home:"); ok {
-			home, homeOK = strings.TrimSpace(v), true
-		}
-	}
-	return top, home, topOK, homeOK
-}
-
-// resumedPackage reads a dumpsys line "topResumedActivity=ActivityRecord{1d5b2a5 u0 <pkg>/<activity> t5}" or
-// "mResumedActivity: ActivityRecord{...}". none: the record is null (nothing resumed). ok=false when the line is
-// neither (empty: dumpsys failed or printed something else).
-func resumedPackage(line string) (pkg string, none, ok bool) {
-	for _, mark := range []string{"topResumedActivity=", "mResumedActivity:"} {
-		k := strings.Index(line, mark)
-		if k < 0 {
-			continue
-		}
-		v := strings.TrimSpace(line[k+len(mark):])
-		if v == "null" {
-			return "", true, true
-		}
-		if p, ok := componentPackage(v); ok {
-			return p, false, true
-		}
-		return "", false, false
-	}
-	return "", false, false
-}
-
-// componentPackage is the package of the first "<pkg>/<class>" field of s (braces around it stripped); ok=false when
-// there is none or the part before the slash is no package name ("No activity found", an error text).
-func componentPackage(s string) (string, bool) {
-	for _, f := range strings.Fields(s) {
-		f = strings.Trim(f, "{}")
-		pkg, _, found := strings.Cut(f, "/")
-		if !found {
-			continue
-		}
-		return pkg, validPackageName(pkg)
-	}
-	return "", false
-}
-
-// validPackageName: letters, digits, '_' and '.', starting with a letter (Android package names).
-func validPackageName(s string) bool {
-	if s == "" {
-		return false
-	}
-	for k, r := range s {
-		switch {
-		case r >= 'a' && r <= 'z', r >= 'A' && r <= 'Z':
-		case k > 0 && (r >= '0' && r <= '9' || r == '_' || r == '.'):
-		default:
-			return false
-		}
-	}
-	return true
-}
-
-// vulkanFixDeferredReport judges vulkanFixCheckScript's output for an owed fix that was not mounted because the
-// guest is in use (b from owedMountGate). pending: the fix applies to this image and is missing, or that cannot be
-// read; the setup marker then stays and msg is vulkanFixDeferredMessage's. Otherwise nothing is owed (mounted
-// already, patched image, unexpected image) and msg is vulkanFixCheckReport's.
-func vulkanFixDeferredReport(i int, out string, b mountBlocker, until, now time.Time, profile vkfix.Profile) (pending bool, msg string) {
-	warn, checkMsg := vulkanFixCheckReport(i, out, profile)
-	if !warn {
-		return false, checkMsg
-	}
-	detail := b.detail
-	if sha, isImage := strings.CutPrefix(lastNonEmptyLine(out), "image "); !isImage || sha != profile.OrigSHA256 {
-		unknown := "这次开机挂没挂也读不出: " + orText(tail(out, 200), "无输出")
-		if detail == "" {
-			detail = unknown
-		} else {
-			detail += "；" + unknown
-		}
-	}
-	return true, vulkanFixDeferredMessage(i, b, detail, until, now)
-}
-
-// vulkanFixDeferredMessage is the warning of an owed fix left out (b: why), with detail in brackets when not "". It
-// names the marker's deadline (until) as local time and that only the next boot mounts it after that: a start after
-// the deadline adopts the boot as an ordinary running instance and only checks the fix.
-func vulkanFixDeferredMessage(i int, b mountBlocker, detail string, until, now time.Time) string {
-	var retry string
-	switch {
-	case until.IsZero():
-		retry = b.then + "再 start 一次，或下次开机自动挂"
-	case !now.Before(until):
-		retry = "这次开机接着做设置的期限（" + clockText(until, now) + "）已过，等下次开机自动挂"
-	default:
-		retry = b.then + "在 " + clockText(until, now) + " 前再 start 一次，过了这个时间就等下次开机自动挂"
-	}
-	msg := fmt.Sprintf("实例 %d 的客体 Vulkan 驱动补丁还没挂：现在%s，挂上要重启 zygote；%s", i, b.what, retry)
-	if detail != "" {
-		msg += "（" + detail + "）"
-	}
-	return msg
-}
-
-// vulkanFixStatus splits vulkanfix.sh's status line: the first word, and what follows the first space (the sha256
-// for MOUNTED / ALREADY). A NEED_UPLOAD... line counts as NEED_UPLOAD etc. (AUTO-MAS startswith); "" for no output.
-func vulkanFixStatus(status string) (kind, rest string) {
-	for _, k := range []string{"NEED_UPLOAD", "ALREADY", "VENDOR_PATCHED", "MOUNTED", "SKIPPED", "FAILED"} {
-		if strings.HasPrefix(status, k) {
-			_, rest, _ = strings.Cut(status, " ")
-			return k, rest
-		}
-	}
-	return "", ""
-}
-
-// patchedVulkanLibrary is the host cache <root>\guest-patches\<vkfix.CacheName>, made when missing or
-// bad: pull the guest's own library, check its hash, patch, check the result's hash (vkfix.Patch), write it. ""
-// when any step fails (logged, nothing mounted). Host I/O errors (disk full, a virus scanner holding the file) are
-// warnings too.
-//
-// Two instances (separate modavd processes) may build it at once: each writes its own temp file and renames it
-// over the cache; one that cannot rename takes the other's file when that has the right hash.
-func (m *Manager) patchedVulkanLibrary(ctx context.Context, i int, profile vkfix.Profile) string {
-	dir := m.Root.GuestPatchDir()
-	library := filepath.Join(dir, profile.CacheName)
-	ioFail := func(err error) string {
-		m.Log.Warnf("实例 %d 客体 Vulkan 驱动补丁没挂: 本机读写补丁库失败（%s）: %v", i, library, err)
-		return ""
-	}
-
-	if data, err := os.ReadFile(library); err == nil {
-		digest := vkfix.SHA256Hex(data)
-		if digest == profile.FixSHA256 {
-			m.Log.Infof("实例 %d 客体 Vulkan 驱动补丁: 用本机缓存 %s", i, library)
-			return library
-		}
-		m.Log.Warnf("本机缓存的客体驱动补丁库哈希不对（%s），重新生成: %s", digest, library)
-	} else if !errors.Is(err, fs.ErrNotExist) {
-		return ioFail(err)
-	}
-	if err := os.MkdirAll(dir, 0o755); err != nil {
-		return ioFail(err)
-	}
-
-	original := filepath.Join(dir, fmt.Sprintf("libvulkan_enc-%d.orig.so", i))
-	defer os.Remove(original)
-	res := m.ADB.Run(ctx, adb.RunOptions{Serial: m.Root.Ports().Serial(i), Timeout: 60 * time.Second, Reregister: true},
-		"pull", vkfix.GuestPath, original)
-	if res.Code != 0 || !regularFile(original) {
-		m.Log.Warnf("实例 %d 客体 Vulkan 驱动补丁没挂: 从客体拉 %s 失败: %s", i, vkfix.GuestPath, tail(res.Out, 200))
-		return ""
-	}
-	data, err := os.ReadFile(original)
-	if err != nil {
-		return ioFail(err)
-	}
-	m.Log.Infof("实例 %d 从客体拉到驱动原库（sha256 %s），本机生成补丁库", i, vkfix.SHA256Hex(data))
-	patched, err := profile.Patch(data)
-	if err != nil {
-		m.Log.Warnf("实例 %d 客体 Vulkan 驱动补丁没挂: %v", i, err)
-		return ""
-	}
-	if err := writeFileReplace(library, patched, fmt.Sprintf("%d-%d", os.Getpid(), i)); err != nil {
-		if b, rerr := os.ReadFile(library); rerr == nil && vkfix.SHA256Hex(b) == profile.FixSHA256 {
-			// another start wrote the same file meanwhile (and may be pushing it right now)
-			return library
-		}
-		return ioFail(err)
-	}
-	m.Log.Infof("实例 %d 已在本机生成客体驱动补丁库（sha256 %s）: %s", i, profile.FixSHA256, library)
-	return library
-}
-
-// writeFileReplace writes path through <path>.<tag>.tmp and a rename over it, retried for up to 3 s while another
-// process has the target open (an adb push reading it). The temp file is removed on failure.
-func writeFileReplace(path string, data []byte, tag string) error {
-	tmp := path + "." + tag + ".tmp"
-	err := os.WriteFile(tmp, data, 0o644)
-	if err == nil {
-		err = root.ReplaceWithRetry(tmp, path)
-	}
-	if err != nil {
-		os.Remove(tmp)
-	}
-	return err
-}
-
-// waitFrameworkBack waits after the zygote restart until SystemUI runs as a new process, then 8 s more (launcher).
-func (m *Manager) waitFrameworkBack(ctx context.Context, g guestIO, uiBefore string, timeout time.Duration) bool {
-	deadline := time.Now().Add(timeout)
-	if !sleepOrDone(ctx, 2*time.Second) {
-		return false
-	}
-	for time.Now().Before(deadline) {
-		res := g.shell("pidof com.android.systemui", 10*time.Second)
-		// pidof exits 1 with no output while SystemUI is down; an adb error text is no new pid either
-		if ui := strings.TrimSpace(res.Out); res.Code == 0 && ui != "" && ui != uiBefore {
-			return sleepOrDone(ctx, 8*time.Second)
-		}
-		if !sleepOrDone(ctx, 2*time.Second) {
-			return false
-		}
-	}
-	return false
-}
diff --git a/internal/emu/vulkanfix_test.go b/internal/emu/vulkanfix_test.go
deleted file mode 100644
index 13e4b94..0000000
--- a/internal/emu/vulkanfix_test.go
+++ /dev/null
@@ -1,462 +0,0 @@
-//go:build windows
-
-package emu
-
-import (
-	"context"
-	"errors"
-	"os"
-	"path/filepath"
-	"reflect"
-	"strings"
-	"testing"
-	"time"
-
-	"modavd/internal/adb"
-	"modavd/internal/logx"
-	"modavd/internal/testutil"
-	"modavd/internal/vkfix"
-	"modavd/internal/win"
-)
-
-func TestVulkanFixStatus(t *testing.T) {
-	fix := vkfix.FixSHA256
-	cases := []struct {
-		out        string
-		kind, rest string
-	}{
-		{"MOUNTED " + fix, "MOUNTED", fix},
-		{"ALREADY " + fix, "ALREADY", fix},
-		{"ALREADY 1234abcd", "ALREADY", "1234abcd"},
-		{"VENDOR_PATCHED", "VENDOR_PATCHED", ""},
-		{"NEED_UPLOAD", "NEED_UPLOAD", ""},
-		{"SKIPPED image 0000", "SKIPPED", "image 0000"},
-		{"SKIPPED patched 1111", "SKIPPED", "patched 1111"},
-		{"FAILED chcon u:object_r:vendor_file:s0 -> u:object_r:shell_data_file:s0", "FAILED",
-			"chcon u:object_r:vendor_file:s0 -> u:object_r:shell_data_file:s0"},
-		{"", "", ""},
-		{"/system/bin/sh: vulkanfix.sh: not found", "", ""},
-	}
-	for _, c := range cases {
-		// the script prints one status line last; adb output may carry other lines before it
-		status := lastNonEmptyLine("some noise\r\n" + c.out + "\r\n")
-		if c.out == "" {
-			status = lastNonEmptyLine("")
-		}
-		kind, rest := vulkanFixStatus(status)
-		if kind != c.kind || rest != c.rest {
-			t.Errorf("vulkanFixStatus(%q) = %q %q; want %q %q", status, kind, rest, c.kind, c.rest)
-		}
-	}
-}
-
-// TestVulkanFixCheckReport: an adopted instance warns only when the fix applies to its image and is not mounted.
-func TestVulkanFixCheckReport(t *testing.T) {
-	cases := []struct {
-		out  string
-		warn bool
-		has  string
-	}{
-		{"mounted\r\n", false, "本次开机已挂上"},
-		{"image " + vkfix.FixSHA256 + "\r\n", false, "已是补丁版"},
-		{"image " + vkfix.OrigSHA256 + "\r\n", true, "要挂就先关掉这个实例再启动"},
-		{"image " + strings.Repeat("ab", 32) + "\n", false, "不是预期的镜像版本"},
-		{"image \n", true, "读不出"},                           // sha256sum failed
-		{"error: device offline\n", true, "device offline"}, // adb failed
-		{"", true, "无输出"},
-	}
-	for _, c := range cases {
-		warn, msg := vulkanFixCheckReport(4, c.out, vkfix.X86Profile())
-		if warn != c.warn || !strings.HasPrefix(msg, "实例 4 ") || !strings.Contains(msg, c.has) {
-			t.Errorf("vulkanFixCheckReport(%q) = %v %q", c.out, warn, msg)
-		}
-	}
-	// the check reads the same mount test as vulkanfix.sh and never needs root
-	if !strings.Contains(vulkanFixCheckScript, "grep -q ' "+vkfix.GuestPath+" ' /proc/self/mountinfo") ||
-		strings.Contains(vulkanFixCheckScript, "su ") {
-		t.Errorf("check script = %s", vulkanFixCheckScript)
-	}
-}
-
-// TestVulkanFixMountAllowed: an owed fix is mounted only when nothing anybody uses is in front: the default home app,
-// SystemUI, or no resumed activity at all. Everything else, unreadable output included, defers it.
-func TestVulkanFixMountAllowed(t *testing.T) {
-	const (
-		homeLight = "home: de.jrpie.android.launcher/de.jrpie.android.launcher.ui.HomeActivity\r\n"
-		homePixel = "home: com.google.android.apps.nexuslauncher/com.android.launcher3.uioverrides.QuickstepLauncher\r\n"
-	)
-	cases := []struct {
-		name    string
-		out     string
-		allowed bool
-		front   string
-	}{
-		{"light launcher in front", "top:   topResumedActivity=ActivityRecord{1d5b2a5 u0 de.jrpie.android.launcher/.ui.HomeActivity t5}\r\n" +
-			homeLight, true, "de.jrpie.android.launcher"},
-		{"pixel launcher (recents) in front", "top: mResumedActivity: ActivityRecord{77 u0 com.google.android.apps.nexuslauncher/" +
-			"com.android.launcher3.uioverrides.QuickstepLauncher t2}\n" + homePixel, true, "com.google.android.apps.nexuslauncher"},
-		{"game in front", "top:     mResumedActivity: ActivityRecord{9f1 u0 com.miHoYo.hkrpg/com.mihoyo.combosdk.ComboSDKActivity t12}\r\n" +
-			homeLight, false, "com.miHoYo.hkrpg"},
-		{"settings in front", "top: topResumedActivity=ActivityRecord{3 u0 com.android.settings/.Settings t9}\n" + homeLight,
-			false, "com.android.settings"},
-		{"systemui in front", "top: topResumedActivity=ActivityRecord{4 u0 com.android.systemui/.SomeActivity t3}\n" + homeLight,
-			true, "com.android.systemui"},
-		{"nothing resumed", "top:   topResumedActivity=null\nhome: \n", true, "无"},
-		// grep -m1 ends dumpsys early: its "Broken pipe" comes on a line of its own
-		{"broken pipe noise", "Broken pipe\r\ntop:   topResumedActivity=ActivityRecord{1 u0 de.jrpie.android.launcher/.ui.HomeActivity t5}\r\n" +
-			"Broken pipe\r\n" + homeLight, true, "de.jrpie.android.launcher"},
-		// the home app in front but no default home known: cannot tell it is home
-		{"home unresolved", "top: topResumedActivity=ActivityRecord{1 u0 com.android.launcher3/.Launcher t1}\nhome: No activity found\n",
-			false, "com.android.launcher3"},
-		{"home tag missing", "top: topResumedActivity=ActivityRecord{1 u0 de.jrpie.android.launcher/.ui.HomeActivity t5}\n",
-			false, "de.jrpie.android.launcher"},
-		// no default home: the resolver; android's chooser activities can sit over a game, so it is no home screen
-		{"resolver as home", "top: topResumedActivity=ActivityRecord{2 u0 android/com.android.internal.app.ChooserActivity t8}\n" +
-			"home: android/com.android.internal.app.ResolverActivity\n", false, "android"},
-		{"dumpsys gave nothing", "top: \r\n" + homeLight, false, ""},
-		{"no component in the record", "top: topResumedActivity=ActivityRecord{1 u0 t1}\n" + homeLight, false, ""},
-		{"not a package name", "top: topResumedActivity=ActivityRecord{1 u0 9bad/.A t1}\n" + homeLight, false, ""},
-		{"adb failed", "error: device 'emulator-20030' not found\r\n", false, ""},
-		{"no output", "", false, ""},
-	}
-	for _, c := range cases {
-		allowed, front := vulkanFixMountAllowed(c.out)
-		if allowed != c.allowed || front != c.front {
-			t.Errorf("%s: vulkanFixMountAllowed = %v %q, want %v %q", c.name, allowed, front, c.allowed, c.front)
-		}
-	}
-}
-
-func TestComponentPackage(t *testing.T) {
-	cases := []struct {
-		in  string
-		pkg string
-		ok  bool
-	}{
-		{"com.android.launcher3/.Launcher", "com.android.launcher3", true},
-		{"ActivityRecord{c5a u0 com.x_y.Z9/.A t9}", "com.x_y.Z9", true},
-		{"{com.a/.B}", "com.a", true},
-		{"android/com.android.internal.app.ResolverActivity", "android", true},
-		{"No activity found", "", false},
-		{"9bad/.A", "9bad", false},
-		{"/.A", "", false},
-		{"", "", false},
-	}
-	for _, c := range cases {
-		if pkg, ok := componentPackage(c.in); pkg != c.pkg || ok != c.ok {
-			t.Errorf("componentPackage(%q) = %q %v, want %q %v", c.in, pkg, ok, c.pkg, c.ok)
-		}
-	}
-}
-
-func TestForegroundProbeScript(t *testing.T) {
-	for _, s := range []string{
-		`echo "top: $(dumpsys activity activities | grep -m1 -E 'topResumedActivity|mResumedActivity')"`,
-		`echo "home: $(cmd package resolve-activity --brief -a android.intent.action.MAIN -c android.intent.category.HOME | tail -n1)"`,
-	} {
-		if !strings.Contains(foregroundProbeScript, s) {
-			t.Errorf("probe lacks %s: %s", s, foregroundProbeScript)
-		}
-	}
-	// read-only, no root
-	if strings.Contains(foregroundProbeScript, "su ") {
-		t.Errorf("probe uses su: %s", foregroundProbeScript)
-	}
-}
-
-// TestVulkanFixDeferredReport: an owed fix left out because the guest is in use stays owed only while the image needs
-// it and it is not mounted (or that cannot be read); the warning names what is in the way and the actual deadline.
-func TestVulkanFixDeferredReport(t *testing.T) {
-	now := time.Date(2026, 10, 28, 18, 0, 0, 0, time.Local)
-	until := now.Add(25*time.Minute + 30*time.Second)
-	const (
-		front   = "实例 3 的客体 Vulkan 驱动补丁还没挂：现在有应用在前台，挂上要重启 zygote；关掉应用后在 18:25 前再 start 一次，过了这个时间就等下次开机自动挂"
-		install = "实例 3 的客体 Vulkan 驱动补丁还没挂：现在有安装正在进行，挂上要重启 zygote；等安装完在 18:25 前再 start 一次，过了这个时间就等下次开机自动挂"
-	)
-	game := foregroundBlocker("com.miHoYo.hkrpg")
-	cases := []struct {
-		name    string
-		out     string
-		b       mountBlocker
-		until   time.Time
-		pending bool
-		msg     string // exact when it starts with 实例, else a part of it
-	}{
-		{"missing, game in front", "image " + vkfix.OrigSHA256 + "\r\n", game, until, true, front + "（前台: com.miHoYo.hkrpg）"},
-		{"missing, front unreadable", "image " + vkfix.OrigSHA256 + "\n", foregroundBlocker(""), until, true,
-			front + "（读不出前台是什么，按有应用在用处理）"},
-		{"check unreadable", "error: device offline\n", game, until, true,
-			front + "（前台: com.miHoYo.hkrpg；这次开机挂没挂也读不出: error: device offline）"},
-		{"check gave nothing", "", game, until, true, front + "（前台: com.miHoYo.hkrpg；这次开机挂没挂也读不出: 无输出）"},
-		{"missing, install running", "image " + vkfix.OrigSHA256 + "\n", installBlocker(nil), until, true, install},
-		{"install lock unreadable", "image " + vkfix.OrigSHA256 + "\n", installBlocker(errors.New("拒绝访问。")), until, true,
-			install + "（安装锁读不了（拒绝访问。），按有安装正在进行处理）"},
-		{"install running, check unreadable", "", installBlocker(nil), until, true, install + "（这次开机挂没挂也读不出: 无输出）"},
-		{"deadline passed", "image " + vkfix.OrigSHA256 + "\n", game, now.Add(-5 * time.Minute), true,
-			"实例 3 的客体 Vulkan 驱动补丁还没挂：现在有应用在前台，挂上要重启 zygote；这次开机接着做设置的期限（17:55）已过，" +
-				"等下次开机自动挂（前台: com.miHoYo.hkrpg）"},
-		{"deadline unknown", "image " + vkfix.OrigSHA256 + "\n", game, time.Time{}, true,
-			"实例 3 的客体 Vulkan 驱动补丁还没挂：现在有应用在前台，挂上要重启 zygote；关掉应用后再 start 一次，或下次开机自动挂（前台: com.miHoYo.hkrpg）"},
-		{"already mounted", "mounted\r\n", game, until, false, "本次开机已挂上"},
-		{"patched image", "image " + vkfix.FixSHA256 + "\n", installBlocker(nil), until, false, "已是补丁版"},
-		{"unexpected image", "image " + strings.Repeat("cd", 32) + "\n", foregroundBlocker(""), until, false, "不是预期的镜像版本"},
-	}
-	for _, c := range cases {
-		pending, msg := vulkanFixDeferredReport(3, c.out, c.b, c.until, now, vkfix.X86Profile())
-		okMsg := msg == c.msg
-		if !strings.HasPrefix(c.msg, "实例") {
-			okMsg = strings.HasPrefix(msg, "实例 3 ") && strings.Contains(msg, c.msg)
-		}
-		if pending != c.pending || !okMsg {
-			t.Errorf("%s: vulkanFixDeferredReport = %v %q", c.name, pending, msg)
-		}
-	}
-}
-
-// fakeVulkanGuest is a guest for mountVulkanFix: canned answers per command, every command recorded by a short name,
-// and for each vulkanfix.sh run whether the guest lock was held meanwhile.
-type fakeVulkanGuest struct {
-	t        *testing.T
-	lock     string   // guestLockPath of the instance
-	probes   []string // successive foregroundProbeScript outputs
-	fixes    []string // successive vulkanfix.sh status lines
-	check    string   // vulkanFixCheckScript output
-	onPush   func()   // runs during the push of the patched library
-	commands []string
-	locked   []bool
-}
-
-const fakeVulkanRemote = "/data/local/tmp/vulkanfix.sh"
-
-func (f *fakeVulkanGuest) io() vulkanFixIO {
-	return vulkanFixIO{
-		guestIO: guestIO{shell: f.shell, adb: f.adb},
-		remote:  fakeVulkanRemote,
-		library: func() string { return `D:\r\guest-patches\` + vkfix.CacheName },
-		waitBack: func(string) bool {
-			f.commands = append(f.commands, "wait")
-			return true
-		},
-	}
-}
-
-func (f *fakeVulkanGuest) shell(command string, _ time.Duration) adb.Result {
-	switch command {
-	case "pidof com.android.systemui":
-		f.commands = append(f.commands, "pidof")
-		return adb.Result{Out: "1234\r\n"}
-	case foregroundProbeScript:
-		f.commands = append(f.commands, "probe")
-		if len(f.probes) == 0 {
-			f.t.Error("probe asked for more often than expected")
-			return adb.Result{Out: ""}
-		}
-		out := f.probes[0]
-		f.probes = f.probes[1:]
-		return adb.Result{Out: out}
-	case vulkanFixCheckScript:
-		f.commands = append(f.commands, "check")
-		return adb.Result{Out: f.check + "\r\n"}
-	case "su 0 sh " + fakeVulkanRemote + " " + vkfix.OrigSHA256 + " " + vkfix.FixSHA256:
-		f.commands = append(f.commands, "fix")
-		// a second handle conflicts like another process does (win.TryLock): busy = somebody holds it
-		l, free, err := win.TryLock(f.lock)
-		if err != nil {
-			f.t.Fatal(err)
-		}
-		l.Unlock()
-		f.locked = append(f.locked, !free)
-		if len(f.fixes) == 0 {
-			f.t.Error("vulkanfix.sh ran more often than expected")
-			return adb.Result{Out: "FAILED test"}
-		}
-		out := f.fixes[0]
-		f.fixes = f.fixes[1:]
-		return adb.Result{Out: out + "\r\n"}
-	}
-	f.t.Errorf("unexpected command %q", command)
-	return adb.Result{Code: 1, Out: "unexpected command"}
-}
-
-func (f *fakeVulkanGuest) adb(_ time.Duration, args ...string) adb.Result {
-	if len(args) == 3 && args[0] == "push" && args[2] == vkfix.UploadPath {
-		f.commands = append(f.commands, "push")
-		if f.onPush != nil {
-			f.onPush()
-		}
-		return adb.Result{Out: "1 file pushed"}
-	}
-	f.t.Errorf("unexpected adb %q", args)
-	return adb.Result{Code: 1, Out: "unexpected adb"}
-}
-
-// TestMountVulkanFix walks the mount against a fake guest. A launched boot mounts without a foreground question but
-// still under the guest lock (an install of another process defers it); an owed one passes owedMountGate before every
-// vulkanfix.sh run that may mount (the guest lock, held over that run and freed right after it, then the foreground
-// probe), so a game launched or an install started while the patched library was being uploaded still defers the
-// zygote restart.
-func TestMountVulkanFix(t *testing.T) {
-	const (
-		gameFront = "top:     mResumedActivity: ActivityRecord{9f1 u0 com.miHoYo.hkrpg/.Game t12}\r\n" +
-			"home: de.jrpie.android.launcher/de.jrpie.android.launcher.ui.HomeActivity\r\n"
-		homeFront = "top:   topResumedActivity=ActivityRecord{1 u0 de.jrpie.android.launcher/.ui.HomeActivity t5}\r\n" +
-			"home: de.jrpie.android.launcher/de.jrpie.android.launcher.ui.HomeActivity\r\n"
-		mounted = "MOUNTED " + vkfix.FixSHA256
-	)
-	until := time.Now().Add(20 * time.Minute)
-	retry := "在 " + clockText(until, time.Now()) + " 前再 start 一次，过了这个时间就等下次开机自动挂"
-	cases := []struct {
-		name               string
-		owed               bool
-		installing         bool // an install holds the guest lock from the start
-		installDuringPush  bool // an install takes it while the library is uploaded
-		probes, fixes      []string
-		check              string
-		commands           []string
-		locked             []bool
-		restarted, pending bool
-		level              logx.Level
-		has                []string
-	}{
-		{name: "launched, cached in the guest", fixes: []string{mounted},
-			commands: []string{"pidof", "fix", "wait"}, locked: []bool{true}, restarted: true,
-			level: logx.Info, has: []string{"客体 Vulkan 驱动补丁已挂上"}},
-		{name: "launched, upload", fixes: []string{"NEED_UPLOAD", mounted},
-			commands: []string{"pidof", "fix", "push", "fix", "wait"}, locked: []bool{true, true}, restarted: true,
-			level: logx.Info, has: []string{"第 3 步（挂载）"}},
-		// a launched boot asks no foreground question, but an install of another process defers the mount the same way
-		{name: "launched, install running", installing: true, check: "image " + vkfix.OrigSHA256,
-			commands: []string{"pidof", "check"}, pending: true,
-			level: logx.Warn, has: []string{"现在有安装正在进行，挂上要重启 zygote；等安装完" + retry}},
-		{name: "owed, home in front, cached", owed: true, probes: []string{homeFront}, fixes: []string{mounted},
-			commands: []string{"pidof", "probe", "fix", "wait"}, locked: []bool{true}, restarted: true,
-			level: logx.Info, has: []string{"没有应用在用，也没有安装在进行，接着挂"}},
-		{name: "owed, game in front", owed: true, probes: []string{gameFront}, check: "image " + vkfix.OrigSHA256,
-			commands: []string{"pidof", "probe", "check"}, pending: true,
-			level: logx.Warn, has: []string{"现在有应用在前台，挂上要重启 zygote；关掉应用后" + retry, "（前台: com.miHoYo.hkrpg）"}},
-		{name: "owed, game in front, fix mounted already", owed: true, probes: []string{gameFront}, check: "mounted",
-			commands: []string{"pidof", "probe", "check"}, level: logx.Info, has: []string{"本次开机已挂上"}},
-		{name: "owed, install running", owed: true, installing: true, check: "image " + vkfix.OrigSHA256,
-			commands: []string{"pidof", "check"}, pending: true,
-			level: logx.Warn, has: []string{"现在有安装正在进行，挂上要重启 zygote；等安装完" + retry}},
-		{name: "owed, install running, fix mounted already", owed: true, installing: true, check: "mounted",
-			commands: []string{"pidof", "check"}, level: logx.Info, has: []string{"本次开机已挂上"}},
-		{name: "owed, upload, game launched meanwhile", owed: true, probes: []string{homeFront, gameFront},
-			fixes: []string{"NEED_UPLOAD"}, commands: []string{"pidof", "probe", "fix", "push", "probe"},
-			locked: []bool{true}, pending: true,
-			level: logx.Warn, has: []string{"现在有应用在前台，挂上要重启 zygote；关掉应用后" + retry, "（前台: com.miHoYo.hkrpg）"}},
-		{name: "owed, upload, still home", owed: true, probes: []string{homeFront, homeFront},
-			fixes: []string{"NEED_UPLOAD", mounted}, commands: []string{"pidof", "probe", "fix", "push", "probe", "fix", "wait"},
-			locked: []bool{true, true}, restarted: true, level: logx.Info, has: []string{"第 3 步（挂载）"}},
-		{name: "owed, upload, install started meanwhile", owed: true, installDuringPush: true, probes: []string{homeFront},
-			fixes: []string{"NEED_UPLOAD"}, commands: []string{"pidof", "probe", "fix", "push"},
-			locked: []bool{true}, pending: true,
-			level: logx.Warn, has: []string{"现在有安装正在进行，挂上要重启 zygote；等安装完" + retry}},
-		{name: "owed, upload, mount failed", owed: true, probes: []string{homeFront, homeFront},
-			fixes: []string{"NEED_UPLOAD", "FAILED mount 0000"}, commands: []string{"pidof", "probe", "fix", "push", "probe", "fix"},
-			locked: []bool{true, true}, level: logx.Warn, has: []string{"客体 Vulkan 驱动补丁没挂: FAILED mount 0000"}},
-	}
-	for _, c := range cases {
-		m := markerTestManager(t)
-		var lines []logLine
-		m.Log = logx.New(func(level logx.Level, msg string) { lines = append(lines, logLine{level, msg}) })
-		f := &fakeVulkanGuest{t: t, lock: m.guestLockPath(3), probes: c.probes, fixes: c.fixes, check: c.check}
-		var install *win.FileLock
-		takeInstall := func() {
-			l, ok, err := win.TryLock(m.guestLockPath(3))
-			if err != nil || !ok {
-				t.Fatalf("%s: install lock: %v %v", c.name, ok, err)
-			}
-			install = l
-		}
-		if c.installing {
-			takeInstall()
-		}
-		if c.installDuringPush {
-			f.onPush = takeInstall
-		}
-
-		restarted, pending := m.mountVulkanFix(context.Background(), 3, f.io(), vkfix.X86Profile(), c.owed, until)
-		install.Unlock()
-
-		if restarted != c.restarted || pending != c.pending {
-			t.Errorf("%s: restarted %v pending %v", c.name, restarted, pending)
-		}
-		if !reflect.DeepEqual(f.commands, c.commands) {
-			t.Errorf("%s: commands %q, want %q", c.name, f.commands, c.commands)
-		}
-		if !reflect.DeepEqual(f.locked, c.locked) {
-			t.Errorf("%s: guest lock held during the runs %v, want %v", c.name, f.locked, c.locked)
-		}
-		if len(f.probes) != 0 || len(f.fixes) != 0 {
-			t.Errorf("%s: answers left over: probes %d, fixes %d", c.name, len(f.probes), len(f.fixes))
-		}
-		// whatever happened, the guest lock is free again
-		if l, ok, err := win.TryLock(m.guestLockPath(3)); err != nil || !ok {
-			t.Errorf("%s: guest lock still held after the mount: %v %v", c.name, ok, err)
-		} else {
-			l.Unlock()
-		}
-		var found bool
-		for _, l := range lines {
-			if l.level == c.level && strings.HasPrefix(l.msg, "实例 3 ") {
-				all := true
-				for _, s := range c.has {
-					all = all && strings.Contains(l.msg, s)
-				}
-				found = found || all
-			}
-			if l.level == logx.Warn && c.level != logx.Warn {
-				t.Errorf("%s: unexpected warning %q", c.name, l.msg)
-			}
-		}
-		if !found {
-			t.Errorf("%s: no %v line with %q in %v", c.name, c.level, c.has, lines)
-		}
-	}
-}
-
-func TestVulkanFixConstants(t *testing.T) {
-	// what vulkanfix.sh is called with and what it expects (u= in the script)
-	if vkfix.UploadPath != "/data/local/tmp/vulkanfix-upload.so" || vkfix.GuestPath != "/vendor/lib64/libvulkan_enc.so" ||
-		vkfix.CacheName != "libvulkan_enc.khrfix-bindlock2-dstpl1.so" {
-		t.Error("vkfix constants changed")
-	}
-}
-
-func TestWriteFileReplace(t *testing.T) {
-	dir := testutil.TempDir(t)
-	path := filepath.Join(dir, vkfix.CacheName)
-	if err := writeFileReplace(path, []byte("first"), "1-0"); err != nil {
-		t.Fatal(err)
-	}
-	if err := writeFileReplace(path, []byte("second"), "2-0"); err != nil {
-		t.Fatal(err)
-	}
-	if b, _ := os.ReadFile(path); string(b) != "second" {
-		t.Errorf("content = %q", b)
-	}
-	entries, _ := os.ReadDir(dir)
-	for _, e := range entries {
-		if strings.HasSuffix(e.Name(), ".tmp") {
-			t.Errorf("temp file left: %s", e.Name())
-		}
-	}
-
-	// the target held open without delete sharing (Go's own open): the rename keeps failing, the temp file goes
-	f, err := os.Open(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	err = writeFileReplace(path, []byte("third"), "3-0")
-	f.Close()
-	if err == nil {
-		t.Log("rename over an open file succeeded on this system")
-	}
-	entries, _ = os.ReadDir(dir)
-	for _, e := range entries {
-		if strings.HasSuffix(e.Name(), ".tmp") {
-			t.Errorf("temp file left after a failed rename: %s", e.Name())
-		}
-	}
-}
diff --git a/internal/guest/guest.go b/internal/guest/guest.go
index 582bf7e..e4832ad 100644
--- a/internal/guest/guest.go
+++ b/internal/guest/guest.go
@@ -58,7 +58,9 @@ const (
 	CPUInfoBind  = "cpuinfo-bind.sh"
 	IdlePoll     = "mas-idlepoll.sh"
 	WifiFastpath = "mas-wifi-fastpath.sh"
-	VulkanFix    = "vulkanfix.sh"
+	// LibFix mounts the patched guest libraries, the Vulkan driver and the ARM translation layer (modavd only;
+	// AUTO-MAS keeps its own vulkanfix.sh for the Vulkan driver alone, with the same guest cache and upload names).
+	LibFix = "libfix.sh"
 	// PlayStore installs, checks and removes the Google Play Store (modavd only, not in AUTO-MAS).
 	PlayStore = "playstore.sh"
 )
diff --git a/internal/guest/guest_test.go b/internal/guest/guest_test.go
index 51fcf86..8c09883 100644
--- a/internal/guest/guest_test.go
+++ b/internal/guest/guest_test.go
@@ -15,7 +15,7 @@ import (
 )
 
 func TestScriptsHaveNoCR(t *testing.T) {
-	for _, name := range []string{CPUInfoBind, IdlePoll, WifiFastpath, VulkanFix} {
+	for _, name := range []string{CPUInfoBind, IdlePoll, WifiFastpath, LibFix, PlayStore} {
 		b, err := Script(name)
 		if err != nil {
 			t.Fatalf("%s: %v", name, err)
@@ -27,8 +27,8 @@ func TestScriptsHaveNoCR(t *testing.T) {
 	if _, err := Script("missing.sh"); err == nil {
 		t.Error("a missing script was found")
 	}
-	if Remote(VulkanFix) != "/data/local/tmp/vulkanfix.sh" {
-		t.Errorf("Remote = %s", Remote(VulkanFix))
+	if Remote(LibFix) != "/data/local/tmp/libfix.sh" {
+		t.Errorf("Remote = %s", Remote(LibFix))
 	}
 }
 
@@ -91,11 +91,11 @@ func TestLocalFileContentAddressed(t *testing.T) {
 	}
 
 	// another script goes to its own address
-	other, err := LocalFile(dir, VulkanFix)
+	other, err := LocalFile(dir, LibFix)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if wantOther, _ := contentPath(t, dir, VulkanFix); other != wantOther {
+	if wantOther, _ := contentPath(t, dir, LibFix); other != wantOther {
 		t.Errorf("other script at %s, want %s", other, wantOther)
 	}
 	noTempFiles(t, dir)
diff --git a/internal/guest/libfix_sh_test.go b/internal/guest/libfix_sh_test.go
new file mode 100644
index 0000000..fc45278
--- /dev/null
+++ b/internal/guest/libfix_sh_test.go
@@ -0,0 +1,352 @@
+package guest
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"modavd/internal/testutil"
+)
+
+// lfGuest is a fake guest for libfix.sh under a POSIX sh (Git's on Windows): MODAVD_LIBFIX_ROOT is a temporary
+// directory standing for /, with a fake /proc/self/mountinfo. mount, umount, chcon, ls and setprop are stubs on PATH:
+//   - mount --bind <src> <dst> keeps the file under it as <dst>.under, copies src over dst and adds dst's guest path to
+//     mountinfo; umount [-l] <dst> puts the file under it back and takes the line out (umount.log records the calls);
+//   - a file's label is in <file>.label (none: shell_data_file); chcon writes it, ls -Z prints it;
+//   - setprop appends its arguments to setprop.log;
+//   - chcon and mount fail (doing nothing) on a path containing what <root>/chcon.fail or mount.fail holds.
+type lfGuest struct {
+	t        *testing.T
+	sh, root string
+	env      []string
+}
+
+// lfLib is one library of the fake image: its guest path, cache and upload paths, and the original and patched
+// contents.
+type lfLib struct {
+	target, cache, upload string
+	orig, fix             string
+}
+
+var (
+	lfNDK = lfLib{"/system/lib64/libndk_translation.so", "/data/local/tmp/libndk_translation.hintnop1.so",
+		"/data/local/tmp/ndkfix-upload.so", "ndk original", "ndk patched"}
+	lfVK = lfLib{"/vendor/lib64/libvulkan_enc.so", "/data/local/tmp/libvulkan_enc.khrfix-bindlock2.so",
+		"/data/local/tmp/vulkanfix-upload.so", "vulkan original", "vulkan patched"}
+)
+
+func lfSum(s string) string {
+	h := sha256.Sum256([]byte(s))
+	return hex.EncodeToString(h[:])
+}
+
+func (l lfLib) args() []string {
+	return []string{l.target, l.cache, l.upload, lfSum(l.orig), lfSum(l.fix)}
+}
+
+func newLFGuest(t *testing.T) *lfGuest {
+	t.Helper()
+	sh, err := exec.LookPath("sh")
+	if err != nil {
+		t.Skip("no sh")
+	}
+	for _, tool := range []string{"sha256sum", "cut", "grep", "cp"} {
+		if _, err := exec.LookPath(tool); err != nil {
+			t.Skip("no " + tool)
+		}
+	}
+	base := testutil.TempDir(t)
+	if strings.ContainsAny(base, " \t") {
+		t.Skip("the temporary directory has a space in its path (the guest's never do)")
+	}
+	g := &lfGuest{t: t, sh: sh, root: filepath.ToSlash(filepath.Join(base, "root"))}
+	bin := filepath.Join(base, "bin")
+	if err := os.MkdirAll(bin, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	g.write("/proc/self/mountinfo", "22 1 253:0 / / ro,relatime - ext4 /dev/root ro\n")
+	g.write("/data/local/tmp/.keep", "")
+	for _, l := range []lfLib{lfNDK, lfVK} {
+		g.write(l.target, l.orig)
+	}
+	g.write(lfNDK.target+".label", "u:object_r:system_lib_file:s0")
+	g.write(lfVK.target+".label", "u:object_r:vendor_file:s0")
+
+	stub := func(name, body string) {
+		if err := os.WriteFile(filepath.Join(bin, name), []byte("#!/bin/sh\nR=$MODAVD_LIBFIX_ROOT\n"+body+"\n"), 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	fails := func(what, path string) string {
+		return `f=$(cat "$R/` + what + `.fail" 2>/dev/null)
+if [ -n "$f" ]; then case "` + path + `" in *"$f"*) echo "` + what + `: failed" >&2; exit 1 ;; esac; fi
+`
+	}
+	stub("mount", `[ "$1" = --bind ] || { echo "mount: unexpected $*" >&2; exit 1; }
+`+fails("mount", "$3")+`[ -e "$3.under" ] || cp "$3" "$3.under"
+cp "$2" "$3"
+echo "40 22 253:5 /local/tmp/x ${3#$R} rw,relatime - ext4 /dev/block/vdc rw" >> "$R/proc/self/mountinfo"`)
+	stub("umount", `[ "$1" = -l ] && shift
+echo "$1" >> "$R/umount.log"
+cp "$1.under" "$1" && rm -f "$1.under"
+grep -vF " ${1#$R} " "$R/proc/self/mountinfo" > "$R/mountinfo.new"; cp "$R/mountinfo.new" "$R/proc/self/mountinfo"`)
+	stub("chcon", fails("chcon", "$2")+`printf %s "$1" > "$2.label"`)
+	stub("ls", `[ "$1" = -Z ] || { echo "ls: unexpected $*" >&2; exit 1; }
+[ -e "$2" ] || exit 1
+echo "$(cat "$2.label" 2>/dev/null || echo u:object_r:shell_data_file:s0) $2"`)
+	stub("setprop", `echo "$*" >> "$R/setprop.log"`)
+	g.env = append(os.Environ(), "MODAVD_LIBFIX_ROOT="+g.root, "MODAVD_PS_STUBS="+filepath.ToSlash(bin))
+	return g
+}
+
+func (g *lfGuest) path(p string) string { return filepath.FromSlash(g.root + p) }
+
+func (g *lfGuest) write(p, data string) {
+	g.t.Helper()
+	if err := os.MkdirAll(filepath.Dir(g.path(p)), 0o755); err != nil {
+		g.t.Fatal(err)
+	}
+	if err := os.WriteFile(g.path(p), []byte(data), 0o644); err != nil {
+		g.t.Fatal(err)
+	}
+}
+
+func (g *lfGuest) read(p string) (string, bool) {
+	b, err := os.ReadFile(g.path(p))
+	return string(b), err == nil
+}
+
+// run runs `sh libfix.sh <args>`: its status per target (what follows "<target> "), its last line and its output.
+func (g *lfGuest) run(args ...string) (map[string]string, string, string) {
+	g.t.Helper()
+	b, err := Script(LibFix)
+	if err != nil {
+		g.t.Fatal(err)
+	}
+	script := g.path("/data/local/tmp/libfix.sh")
+	if err := os.WriteFile(script, b, 0o644); err != nil {
+		g.t.Fatal(err)
+	}
+	cmd := exec.Command(g.sh, append([]string{"-c", stubbedSh, "sh", filepath.ToSlash(script)}, args...)...)
+	cmd.Env = g.env
+	out, _ := cmd.CombinedOutput()
+	status := map[string]string{}
+	last := ""
+	for _, line := range strings.Split(strings.ReplaceAll(string(out), "\r", ""), "\n") {
+		if line = strings.TrimSpace(line); line == "" {
+			continue
+		}
+		last = line
+		for _, l := range []lfLib{lfNDK, lfVK} {
+			if rest, ok := strings.CutPrefix(line, l.target+" "); ok {
+				status[l.target] = rest
+			}
+		}
+	}
+	return status, last, string(out)
+}
+
+func (g *lfGuest) mount(libs ...lfLib) (map[string]string, string, string) {
+	args := []string{"mount"}
+	for _, l := range libs {
+		args = append(args, l.args()...)
+	}
+	return g.run(args...)
+}
+
+func (g *lfGuest) restarts() int {
+	log, _ := g.read("/setprop.log")
+	if n := strings.Count(log, "ctl.restart zygote"); n != strings.Count(log, "\n") {
+		g.t.Errorf("setprop calls: %q", log)
+	}
+	return strings.Count(log, "ctl.restart zygote")
+}
+
+func (g *lfGuest) mountedOver(target string) bool {
+	mi, _ := g.read("/proc/self/mountinfo")
+	return strings.Contains(mi, " "+target+" ")
+}
+
+// cache puts the guest's cached patched copy of l in place (as an earlier boot left it).
+func (g *lfGuest) cache(l lfLib) { g.write(l.cache, l.fix) }
+
+func TestLibFixScriptEmbedded(t *testing.T) {
+	b, err := Script(LibFix)
+	if err != nil || len(b) == 0 || strings.ContainsRune(string(b), '\r') {
+		t.Fatalf("%d bytes, %v", len(b), err)
+	}
+}
+
+// TestLibFixMount: with both caches in place both are mounted (relabelled like their targets), zygote restarts once;
+// the next run finds them mounted and changes nothing.
+func TestLibFixMount(t *testing.T) {
+	g := newLFGuest(t)
+	g.cache(lfNDK)
+	g.cache(lfVK)
+	st, last, out := g.mount(lfVK, lfNDK)
+	if st[lfNDK.target] != "MOUNTED "+lfSum(lfNDK.fix) || st[lfVK.target] != "MOUNTED "+lfSum(lfVK.fix) || last != "RESTARTED" {
+		t.Fatalf("mount: %v %s\n%s", st, last, out)
+	}
+	for _, l := range []lfLib{lfNDK, lfVK} {
+		if got, _ := g.read(l.target); got != l.fix || !g.mountedOver(l.target) {
+			t.Errorf("%s: %q mounted %v", l.target, got, g.mountedOver(l.target))
+		}
+		want, _ := g.read(l.target + ".label")
+		if got, _ := g.read(l.cache + ".label"); got != want {
+			t.Errorf("%s: cache label %q, want %q", l.target, got, want)
+		}
+	}
+	if n := g.restarts(); n != 1 {
+		t.Errorf("zygote restarted %d times, want once", n)
+	}
+
+	st, last, out = g.mount(lfVK, lfNDK)
+	if st[lfNDK.target] != "ALREADY "+lfSum(lfNDK.fix) || st[lfVK.target] != "ALREADY "+lfSum(lfVK.fix) || last != "UNCHANGED" {
+		t.Errorf("again: %v %s\n%s", st, last, out)
+	}
+	if n := g.restarts(); n != 1 {
+		t.Errorf("zygote restarted %d times after the second run, want once", n)
+	}
+}
+
+// TestLibFixUpload: while one library waits for its upload nothing is mounted (the other says READY); the run after
+// the upload takes it into the cache and mounts both.
+func TestLibFixUpload(t *testing.T) {
+	g := newLFGuest(t)
+	g.cache(lfVK)
+	g.write(lfNDK.upload, "half an upload")
+	st, last, out := g.mount(lfVK, lfNDK)
+	if st[lfNDK.target] != "NEED_UPLOAD" || st[lfVK.target] != "READY" || last != "UNCHANGED" {
+		t.Fatalf("first run: %v %s\n%s", st, last, out)
+	}
+	if g.mountedOver(lfVK.target) || g.mountedOver(lfNDK.target) || g.restarts() != 0 {
+		t.Fatal("mounted or restarted while an upload was missing")
+	}
+	if _, ok := g.read(lfNDK.upload); ok {
+		t.Error("the bad upload was left")
+	}
+
+	g.write(lfNDK.upload, lfNDK.fix)
+	st, last, out = g.mount(lfVK, lfNDK)
+	if st[lfNDK.target] != "MOUNTED "+lfSum(lfNDK.fix) || st[lfVK.target] != "MOUNTED "+lfSum(lfVK.fix) || last != "RESTARTED" {
+		t.Fatalf("after the upload: %v %s\n%s", st, last, out)
+	}
+	if got, _ := g.read(lfNDK.cache); got != lfNDK.fix {
+		t.Errorf("cache %q", got)
+	}
+	if _, ok := g.read(lfNDK.upload); ok {
+		t.Error("the upload was left after it was taken into the cache")
+	}
+	if n := g.restarts(); n != 1 {
+		t.Errorf("zygote restarted %d times, want once", n)
+	}
+}
+
+// TestLibFixImageMismatch: an image library with another hash is left alone (and its cache is not used); the other
+// library is still mounted.
+func TestLibFixImageMismatch(t *testing.T) {
+	g := newLFGuest(t)
+	g.cache(lfNDK)
+	g.cache(lfVK)
+	g.write(lfNDK.target, "another release")
+	st, last, out := g.mount(lfVK, lfNDK)
+	if st[lfNDK.target] != "SKIPPED image "+lfSum("another release") || st[lfVK.target] != "MOUNTED "+lfSum(lfVK.fix) ||
+		last != "RESTARTED" {
+		t.Fatalf("%v %s\n%s", st, last, out)
+	}
+	if got, _ := g.read(lfNDK.target); got != "another release" || g.mountedOver(lfNDK.target) {
+		t.Errorf("the unexpected library was touched: %q", got)
+	}
+}
+
+// TestLibFixNothingToDo: no such file, or the image's own already patched: no mount, no restart.
+func TestLibFixNothingToDo(t *testing.T) {
+	g := newLFGuest(t)
+	g.cache(lfNDK)
+	g.cache(lfVK)
+	os.Remove(g.path(lfNDK.target))
+	g.write(lfVK.target, lfVK.fix)
+	st, last, out := g.mount(lfVK, lfNDK)
+	if st[lfNDK.target] != "ABSENT" || st[lfVK.target] != "IMAGE_PATCHED" || last != "UNCHANGED" || g.restarts() != 0 {
+		t.Fatalf("%v %s\n%s", st, last, out)
+	}
+}
+
+// TestLibFixFailures: a chcon or mount that does not take leaves that library unmounted; the other is mounted.
+func TestLibFixFailures(t *testing.T) {
+	g := newLFGuest(t)
+	g.cache(lfNDK)
+	g.cache(lfVK)
+	g.write("/chcon.fail", "libndk")
+	st, last, out := g.mount(lfVK, lfNDK)
+	if !strings.HasPrefix(st[lfNDK.target], "FAILED chcon u:object_r:system_lib_file:s0 -> ") ||
+		st[lfVK.target] != "MOUNTED "+lfSum(lfVK.fix) || last != "RESTARTED" {
+		t.Fatalf("chcon: %v %s\n%s", st, last, out)
+	}
+	if g.mountedOver(lfNDK.target) {
+		t.Error("mounted although chcon failed")
+	}
+
+	g = newLFGuest(t)
+	g.cache(lfNDK)
+	g.write("/mount.fail", "libndk")
+	st, last, out = g.mount(lfNDK)
+	if st[lfNDK.target] != "FAILED mount "+lfSum(lfNDK.orig) || last != "UNCHANGED" || g.restarts() != 0 {
+		t.Fatalf("mount: %v %s\n%s", st, last, out)
+	}
+	if got, _ := g.read(lfNDK.target); got != lfNDK.orig || g.mountedOver(lfNDK.target) {
+		t.Errorf("after a failed mount: %q", got)
+	}
+}
+
+// TestLibFixRevert: revert takes the patched copy away (the image's file is back, zygote restarts), leaves a mount
+// that is not ours alone, and a second revert finds nothing to do.
+func TestLibFixRevert(t *testing.T) {
+	g := newLFGuest(t)
+	g.cache(lfNDK)
+	g.cache(lfVK)
+	if _, last, out := g.mount(lfVK, lfNDK); last != "RESTARTED" {
+		t.Fatalf("mount: %s\n%s", last, out)
+	}
+	st, last, out := g.run("revert", lfNDK.target, lfSum(lfNDK.fix))
+	if st[lfNDK.target] != "REVERTED "+lfSum(lfNDK.orig) || last != "RESTARTED" {
+		t.Fatalf("revert: %v %s\n%s", st, last, out)
+	}
+	if got, _ := g.read(lfNDK.target); got != lfNDK.orig || g.mountedOver(lfNDK.target) {
+		t.Errorf("after revert: %q, mounted %v", got, g.mountedOver(lfNDK.target))
+	}
+	if log, _ := g.read("/umount.log"); !strings.Contains(log, lfNDK.target) {
+		t.Errorf("umount calls: %q", log)
+	}
+	if got, _ := g.read(lfVK.target); got != lfVK.fix || !g.mountedOver(lfVK.target) {
+		t.Error("revert of one library touched the other")
+	}
+	if n := g.restarts(); n != 2 {
+		t.Errorf("zygote restarted %d times, want twice (mount, revert)", n)
+	}
+
+	st, last, out = g.run("revert", lfNDK.target, lfSum(lfNDK.fix), lfVK.target, lfSum("someone else's"))
+	if st[lfNDK.target] != "NOT_MOUNTED" || st[lfVK.target] != "OTHER "+lfSum(lfVK.fix) || last != "UNCHANGED" {
+		t.Errorf("second revert: %v %s\n%s", st, last, out)
+	}
+	if !g.mountedOver(lfVK.target) || g.restarts() != 2 {
+		t.Error("a mount that is not ours was taken away")
+	}
+}
+
+func TestLibFixUsage(t *testing.T) {
+	g := newLFGuest(t)
+	for _, args := range [][]string{{}, {"mount"}, {"mount", "a", "b"}, {"revert", "a"}, {"frobnicate"}} {
+		_, last, out := g.run(args...)
+		if !strings.HasPrefix(last, "usage: ") {
+			t.Errorf("%q: %s", args, out)
+		}
+	}
+	if g.restarts() != 0 {
+		t.Error("a usage error restarted zygote")
+	}
+}
diff --git a/internal/guest/scripts/libfix.sh b/internal/guest/scripts/libfix.sh
new file mode 100644
index 0000000..8077d33
--- /dev/null
+++ b/internal/guest/scripts/libfix.sh
@@ -0,0 +1,115 @@
+#!/system/bin/sh
+# libfix.sh - bind-mount patched copies of guest libraries over the image's own and restart zygote once, so that every
+# app gets them (zygote preloads the Vulkan driver and loads the ARM translation layer before it forks any app). Run
+# as root by modavd (internal/emu/guestfix.go, ModAVD/ModAVD#131):
+#   sh libfix.sh mount  <target> <cache> <upload> <orig sha256> <fix sha256> [<target> <cache> <upload> <orig> <fix>]...
+#   sh libfix.sh revert <target> <fix sha256> [<target> <fix sha256>]...
+# The patched files are made on the host from the image's own libraries (internal/vkfix, internal/ndkfix) and never
+# shipped. The image is never written: a mount lasts until the guest shuts down, revert takes it away sooner.
+#
+# Each patched copy stays in its <cache> (in /data/local/tmp) for the next boots. The cache is relabelled like
+# <target>, which adb cannot write any more, so the host uploads to <upload> and the script takes that in.
+#
+# mount prints one line per library, "<target> <STATUS> [details]":
+#   ALREADY <sha256>         something is mounted over it this boot already (its hash follows): left alone
+#   ABSENT                   the image has no such file: nothing to do
+#   IMAGE_PATCHED            the image's own file already is the patched one: nothing to do
+#   SKIPPED image <sha256>   the image's file has an unexpected hash: left alone
+#   SKIPPED patched <sha256> the cached copy was bad: removed, not mounted; the next run asks for an upload
+#   NEED_UPLOAD              no valid cached copy: upload the patched file to <upload> and run again
+#   READY                    could be mounted, but another library waits for its upload: not mounted this run
+#   MOUNTED <sha256>         mounted now
+#   FAILED <step> ...        chcon / mount did not take: nothing left mounted over it
+# A first, read-only round checks them all (taking a valid upload into the cache is its only write); while any says
+# NEED_UPLOAD the run mounts none. So whatever is mounted is mounted in the same run as the zygote restart: a mount
+# without the restart would leave zygote on the old file while mountinfo already says mounted. The last line is
+# RESTARTED (something was mounted, zygote restarted once) or UNCHANGED.
+#
+# revert unmounts the patched copy (<fix sha256>) from <target>: "<target> REVERTED <sha256 now>", NOT_MOUNTED,
+# OTHER <sha256> (something else is mounted there: left alone) or FAILED umount; the last line as above. The unmount
+# is lazy (processes that have the patched file mapped keep it until they end, and the zygote restart ends them).
+#
+# MODAVD_LIBFIX_ROOT prefixes every absolute path (tests only; unset in the guest).
+R=${MODAVD_LIBFIX_ROOT:-}
+MI=$R/proc/self/mountinfo
+
+sum() { sha256sum "$R$1" 2>/dev/null | cut -d' ' -f1; }
+label() { ls -Z "$R$1" 2>/dev/null | cut -d' ' -f1; }
+mounted() { grep -qF " $1 " "$MI"; }
+
+finish() {
+  if [ "$1" = 1 ]; then setprop ctl.restart zygote; echo RESTARTED; else echo UNCHANGED; fi
+  exit 0
+}
+
+case $1 in
+mount)
+  shift
+  [ $# -gt 0 ] && [ $(($# % 5)) -eq 0 ] || { echo "usage: libfix.sh mount (<target> <cache> <upload> <orig> <fix>)..."; exit 2; }
+  need=0
+  ready=
+  while [ $# -ge 5 ]; do
+    t=$1 c=$2 u=$3 o=$4 f=$5
+    shift 5
+    if mounted "$t"; then echo "$t ALREADY $(sum "$t")"; continue; fi
+    [ -e "$R$t" ] || { echo "$t ABSENT"; continue; }
+    cur=$(sum "$t")
+    [ "$cur" = "$f" ] && { echo "$t IMAGE_PATCHED"; continue; }
+    [ "$cur" = "$o" ] || { echo "$t SKIPPED image $cur"; continue; }
+    if [ "$(sum "$c")" != "$f" ]; then
+      [ "$(sum "$u")" = "$f" ] || { rm -f "$R$u"; echo "$t NEED_UPLOAD"; need=1; continue; }
+      rm -f "$R$c"; cp "$R$u" "$R$c"; rm -f "$R$u"
+    fi
+    got=$(sum "$c")
+    [ "$got" = "$f" ] || { rm -f "$R$c"; echo "$t SKIPPED patched $got"; continue; }
+    ready="$ready $t $c $f"
+  done
+  if [ $need = 1 ]; then
+    set -- $ready
+    while [ $# -ge 3 ]; do echo "$1 READY"; shift 3; done
+    finish 0
+  fi
+  changed=0
+  set -- $ready
+  while [ $# -ge 3 ]; do
+    t=$1 c=$2 f=$3
+    shift 3
+    l=$(label "$t")
+    chmod 644 "$R$c"
+    chcon "$l" "$R$c"
+    now=$(label "$c")
+    [ -n "$l" ] && [ "$now" = "$l" ] || { echo "$t FAILED chcon $l -> $now"; continue; }
+    mount --bind "$R$c" "$R$t"
+    got=$(sum "$t")
+    if [ "$got" != "$f" ]; then
+      mounted "$t" && umount "$R$t"
+      echo "$t FAILED mount $got"
+      continue
+    fi
+    echo "$t MOUNTED $got"
+    changed=1
+  done
+  finish $changed
+  ;;
+revert)
+  shift
+  [ $# -gt 0 ] && [ $(($# % 2)) -eq 0 ] || { echo "usage: libfix.sh revert (<target> <fix>)..."; exit 2; }
+  changed=0
+  while [ $# -ge 2 ]; do
+    t=$1 f=$2
+    shift 2
+    mounted "$t" || { echo "$t NOT_MOUNTED"; continue; }
+    cur=$(sum "$t")
+    [ "$cur" = "$f" ] || { echo "$t OTHER $cur"; continue; }
+    umount -l "$R$t"
+    if mounted "$t"; then echo "$t FAILED umount"; continue; fi
+    echo "$t REVERTED $(sum "$t")"
+    changed=1
+  done
+  finish $changed
+  ;;
+*)
+  echo "usage: libfix.sh mount|revert ..."
+  exit 2
+  ;;
+esac
diff --git a/internal/guest/scripts/vulkanfix.sh b/internal/guest/scripts/vulkanfix.sh
deleted file mode 100644
index 1e1b259..0000000
--- a/internal/guest/scripts/vulkanfix.sh
+++ /dev/null
@@ -1,45 +0,0 @@
-#!/system/bin/sh
-# vulkanfix.sh <orig sha256> <patched sha256> - bind-mount the patched guest Vulkan encoder (bindlock2, includes
-# khrfix) over the image's own and restart zygote (it preloads the driver). Run as root (su 0 sh ...). The launcher's
-# Vulkan fix runs the same steps; the patch itself is made on the host from the image's own library
-# (app/utils/common/emulator2/avd/vulkanfix.py), the patched file is never shipped.
-#
-# The patched copy stays in /data/local/tmp as a cache: the next boot mounts it again without a new upload. It is
-# relabelled for /vendor and then no longer writable by adb, so the host uploads under a separate name.
-#
-# Prints one status line, first word:
-#   MOUNTED <sha256>        mounted now and zygote restarted
-#   ALREADY <sha256>        something is already mounted over the library this boot (its hash follows)
-#   VENDOR_PATCHED          the image's own library already is the patched one: nothing to do
-#   NEED_UPLOAD             no valid cached copy: upload the patched file to $u and run again
-#   SKIPPED image <sha256>  the image's library has an unexpected hash: nothing changed
-#   SKIPPED patched <sha256> the copy in $p is bad: removed, nothing mounted; the next run asks for a new upload
-#   FAILED <step> ...       chcon / mount did not take: nothing left mounted, zygote not restarted
-v=/vendor/lib64/libvulkan_enc.so
-p=/data/local/tmp/libvulkan_enc.khrfix-bindlock2.so
-u=/data/local/tmp/vulkanfix-upload.so
-orig=$1
-fix=$2
-if grep -q " $v " /proc/self/mountinfo; then echo "ALREADY $(sha256sum $v | cut -d' ' -f1)"; exit 0; fi
-cur=$(sha256sum $v | cut -d' ' -f1)
-[ "$cur" = "$fix" ] && { echo "VENDOR_PATCHED"; exit 0; }
-[ "$cur" = "$orig" ] || { echo "SKIPPED image $cur"; exit 0; }
-if [ "$(sha256sum $p 2>/dev/null | cut -d' ' -f1)" != "$fix" ]; then
-  [ "$(sha256sum $u 2>/dev/null | cut -d' ' -f1)" = "$fix" ] || { rm -f $u; echo "NEED_UPLOAD"; exit 0; }
-  rm -f $p; cp $u $p; rm -f $u
-fi
-got=$(sha256sum $p | cut -d' ' -f1)
-[ "$got" = "$fix" ] || { rm -f $p; echo "SKIPPED patched $got"; exit 0; }
-label=$(ls -Z $v | cut -d' ' -f1)
-chmod 644 $p
-chcon $label $p
-[ "$(ls -Z $p | cut -d' ' -f1)" = "$label" ] || { echo "FAILED chcon $label -> $(ls -Z $p | cut -d' ' -f1)"; exit 0; }
-mount --bind $p $v
-got=$(sha256sum $v | cut -d' ' -f1)
-if [ "$got" != "$fix" ]; then
-  grep -q " $v " /proc/self/mountinfo && umount $v
-  echo "FAILED mount $got"
-  exit 0
-fi
-setprop ctl.restart zygote
-echo "MOUNTED $got"
diff --git a/internal/guestpatch/guestpatch.go b/internal/guestpatch/guestpatch.go
new file mode 100644
index 0000000..4984d8a
--- /dev/null
+++ b/internal/guestpatch/guestpatch.go
@@ -0,0 +1,66 @@
+// Package guestpatch lists the guest library patches modavd bind-mounts after boot (internal/emu/guestfix.go,
+// internal/guest/scripts/libfix.sh): per library its path in the image, the hash it must have there, and the patched
+// copy made from it on the user's machine (the patched files are never distributed).
+package guestpatch
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+
+	"modavd/internal/ndkfix"
+	"modavd/internal/vkfix"
+)
+
+// SHA256Hex is the lower-case hex sha256 the profiles and libfix.sh compare.
+func SHA256Hex(b []byte) string {
+	sum := sha256.Sum256(b)
+	return hex.EncodeToString(sum[:])
+}
+
+// Profile keeps one verified guest library's byte contract together. An ABI alone does not make a different
+// Android release compatible with a binary patch: the image's file has to have OrigSHA256.
+type Profile struct {
+	Name string // the patch, in messages: "客体 Vulkan 驱动补丁"
+	Lib  string // the library, in messages: "客体驱动库"
+
+	GuestPath  string // the image's library, where the patched copy is mounted
+	CachePath  string // the guest's cached patched copy (relabelled like GuestPath, so adb cannot write it)
+	UploadPath string // where the host pushes the patched copy when the guest has no valid cache
+	CacheName  string // file name of the host's cached patched copy in <root>\guest-patches
+
+	OrigSHA256 string
+	FixSHA256  string
+	Patch      func([]byte) ([]byte, error)
+}
+
+// guestCacheDir holds the guest caches, next to the scripts.
+const guestCacheDir = "/data/local/tmp/"
+
+// Vulkan is the guest Vulkan encoder fix (khrfix + bindlock2 + template rollover, internal/vkfix). Its upload name is
+// AUTO-MAS's vulkanfix.sh's; the cache name and hash are not (AUTO-MAS's library lacks the template fix), so a library
+// AUTO-MAS mounted reads as ALREADY with another hash and is left alone until the next boot.
+func Vulkan() Profile {
+	return Profile{Name: "客体 Vulkan 驱动补丁", Lib: "客体驱动库",
+		GuestPath: vkfix.GuestPath, CachePath: guestCacheDir + vkfix.CacheName, UploadPath: vkfix.UploadPath,
+		CacheName: vkfix.CacheName, OrigSHA256: vkfix.OrigSHA256, FixSHA256: vkfix.FixSHA256, Patch: vkfix.Patch}
+}
+
+// NDK is the ARM translation layer fix (WFE / WFI / SEV / SEVL as NOP, internal/ndkfix; ModAVD/ModAVD#131).
+func NDK() Profile {
+	return Profile{Name: "ARM 转译层补丁", Lib: "ARM 转译层库",
+		GuestPath: ndkfix.GuestPath, CachePath: guestCacheDir + ndkfix.CacheName, UploadPath: ndkfix.UploadPath,
+		CacheName: ndkfix.CacheName, OrigSHA256: ndkfix.OrigSHA256, FixSHA256: ndkfix.FixSHA256, Patch: ndkfix.Patch}
+}
+
+// ForABI selects the patches for the instance's guest ABI, independently of the manager's host architecture. Only
+// the API34 x86_64 image's libraries are verified. An ARM64 guest runs ARM code natively (no translation layer), and
+// the Mac API35 image has no /vendor/lib64/libvulkan_enc.so; its different Vulkan HAL must not inherit either the
+// retired API34 ARM64 edits or the x86 patch. nil: nothing applies.
+func ForABI(abi string) []Profile {
+	switch abi {
+	case "x86_64":
+		return []Profile{Vulkan(), NDK()}
+	default:
+		return nil
+	}
+}
diff --git a/internal/guestpatch/guestpatch_test.go b/internal/guestpatch/guestpatch_test.go
new file mode 100644
index 0000000..c8d861c
--- /dev/null
+++ b/internal/guestpatch/guestpatch_test.go
@@ -0,0 +1,56 @@
+package guestpatch
+
+import (
+	"strings"
+	"testing"
+
+	"modavd/internal/ndkfix"
+	"modavd/internal/vkfix"
+)
+
+// TestForABI: only the verified x86_64 image gets patches, both of them; ARM64 (native ARM code, an unvalidated
+// Vulkan HAL), an empty and an unknown ABI get none.
+func TestForABI(t *testing.T) {
+	ps := ForABI("x86_64")
+	if len(ps) != 2 || ps[0].GuestPath != vkfix.GuestPath || ps[1].GuestPath != ndkfix.GuestPath {
+		t.Fatalf("x86_64: %+v", ps)
+	}
+	for _, abi := range []string{"arm64-v8a", "", "x86", "X86_64", "mips"} {
+		if ps := ForABI(abi); ps != nil {
+			t.Errorf("%q: %+v", abi, ps)
+		}
+	}
+}
+
+// TestProfiles: each profile carries its own package's contract, and every guest path is one libfix.sh can take
+// (absolute, no blanks: the script splits its arguments on them).
+func TestProfiles(t *testing.T) {
+	vk, ndk := Vulkan(), NDK()
+	if vk.OrigSHA256 != vkfix.OrigSHA256 || vk.FixSHA256 != vkfix.FixSHA256 || vk.CacheName != vkfix.CacheName ||
+		vk.UploadPath != vkfix.UploadPath || vk.Patch == nil {
+		t.Errorf("vulkan: %+v", vk)
+	}
+	if ndk.OrigSHA256 != ndkfix.OrigSHA256 || ndk.FixSHA256 != ndkfix.FixSHA256 || ndk.CacheName != ndkfix.CacheName ||
+		ndk.UploadPath != ndkfix.UploadPath || ndk.Patch == nil {
+		t.Errorf("ndk: %+v", ndk)
+	}
+	seen := map[string]bool{}
+	for _, p := range []Profile{vk, ndk} {
+		for _, s := range []string{p.GuestPath, p.CachePath, p.UploadPath} {
+			if !strings.HasPrefix(s, "/") || strings.ContainsAny(s, " \t'\"") || seen[s] {
+				t.Errorf("%s: path %q", p.Name, s)
+			}
+			seen[s] = true
+		}
+		if len(p.OrigSHA256) != 64 || len(p.FixSHA256) != 64 || p.Name == "" || p.Lib == "" {
+			t.Errorf("%s: %+v", p.Name, p)
+		}
+	}
+	// the patch refuses anything but its image's library
+	if out, err := ndk.Patch([]byte("x")); out != nil || err == nil {
+		t.Error("ndk patch accepted junk")
+	}
+	if SHA256Hex(nil) != "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" {
+		t.Error("SHA256Hex")
+	}
+}
diff --git a/internal/mcp/mcp_test.go b/internal/mcp/mcp_test.go
index df13ede..bda2438 100644
--- a/internal/mcp/mcp_test.go
+++ b/internal/mcp/mcp_test.go
@@ -1463,7 +1463,7 @@ func TestStartDescriptionTellsWhatCancelDoes(t *testing.T) {
 		}
 		for _, s := range []string{"Cancelling or reaching timeout_s only stops waiting",
 			"the emulator keeps booting", "calling start_instance again before the deadline",
-			"finishes that boot's setup", "guest Vulkan fix", "setup_pending=true",
+			"finishes that boot's setup", "guest library fixes: Vulkan driver, ARM translation layer", "setup_pending=true",
 			"window naming the other way fails with busy (no switch while it runs: stop it first)"} {
 			if !strings.Contains(tool.Description, s) {
 				t.Errorf("description lacks %q: %s", s, tool.Description)
diff --git a/internal/mcp/tools.go b/internal/mcp/tools.go
index 68205e1..24a33cd 100644
--- a/internal/mcp/tools.go
+++ b/internal/mcp/tools.go
@@ -320,10 +320,10 @@ func toolDefs() []*toolDef {
 				"while it runs: stop it first). Sends progress notifications with a progressToken. Cancelling or "+
 				"reaching timeout_s only stops waiting: the emulator keeps booting, and calling start_instance "+
 				"again before the deadline in the error's advice (launch + max(timeout_s, %d s) + %d min) finishes "+
-				"that boot's setup, one-time steps included (first-boot setup, guest Vulkan fix). Mounting the "+
-				"Vulkan fix restarts zygote (every app ends), so it is mounted only while no app is in the "+
-				"foreground and no install_apk runs; otherwise setup_pending=true: call again before the deadline, "+
-				"or the next boot mounts it.",
+				"that boot's setup, one-time steps included (first-boot setup, guest library fixes: Vulkan driver, "+
+				"ARM translation layer). Mounting them restarts zygote (every app ends), so they are mounted only "+
+				"while no app is in the foreground and no install_apk runs; otherwise setup_pending=true: call "+
+				"again before the deadline, or the next boot mounts them.",
 				int(emu.DefaultBootTimeout/time.Second), int(emu.DefaultBootTimeout/time.Second),
 				int(emu.SetupMarkerGrace/time.Minute)),
 			mutating(false, true), reflect.TypeFor[emu.StartResult](), []prop{
diff --git a/internal/ndkfix/ndkfix.go b/internal/ndkfix/ndkfix.go
new file mode 100644
index 0000000..7c72cfa
--- /dev/null
+++ b/internal/ndkfix/ndkfix.go
@@ -0,0 +1,165 @@
+// Package ndkfix builds the patched ARM translation layer from the image's own /system/lib64/libndk_translation.so
+// (Google's android-34 google_apis x86_64 r14 image, ndk_translation 0.2.3) on the user's machine; the patched file is
+// never distributed (ModAVD/ModAVD#131).
+//
+// The library has three AArch64 decoders (heavy optimizer, light translator, interpreter; the interpreter's is inlined
+// into InterpretInsn), and all three decode HINT (op0=00, CRn=0010) the same way, on CRm:op2 = insn[11:5]:
+//
+//	if CRm:op2 >= 6               -> NOP path       (ja  rel32)
+//	if (CRm:op2 & ~1) - 2 <= 3    -> UndefinedInsn  (jbe rel32)   CRm:op2 = 2, 3, 4, 5
+//	                              -> NOP path       (jmp rel32)   CRm:op2 = 0, 1
+//
+// So NOP, YIELD and every hint from 6 up (BTI, PAC*, CSDB, unallocated ones) already run as NOP, while WFE (2), WFI (3),
+// SEV (4) and SEVL (5) reach UndefinedInsn, which logs "Undefined instruction 0x%08x at 0x%016zx" and raises SIGILL.
+// ARMv8 executes an unimplemented HINT as a NOP, and Linux lets EL0 run all four: Unity 6's spin locks do (World of
+// Airports 3.7.3 died on SEVL, 0xd50320bf). Each decoder's 6-byte `jbe` becomes a 6-byte NOP, so the four fall
+// through into the `jmp` NOP and YIELD take: the translators emit nothing, the interpreter moves pc on by 4.
+//
+// WFE and WFI may return at once (spurious wake-ups; software loops on its own condition), and SEV / SEVL only set the
+// event register that WFE reads, so as NOPs the only visible difference is that a WFE wait spins.
+//
+// The edit is in place and of the same length: build-id, dynamic symbols, relocations, GOT and data stay as they are.
+// The execution bridge's companion depends on that: it turns on its fork locks by this build-id, at fixed .bss
+// offsets, and finds the translator's exports by name.
+package ndkfix
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"debug/elf"
+	"encoding/binary"
+	"encoding/hex"
+	"strings"
+
+	"modavd/internal/errs"
+)
+
+const (
+	// The image's library (API 34 google_apis x86_64 r14, 2400920 bytes, build-id BuildID) and the patched one.
+	OrigSHA256 = "a2086fbc807f697f9b91222065c9d9000ca9727748699c0d9b751319258cbb3e"
+	FixSHA256  = "3efa8977dbc8c96c9de790ea6e88b9dcd2ccdc18fcec8545f8927e6636a040ee"
+	BuildID    = "553ba82b76bb5a11fd1d67b2c7e01b75"
+	// Where the guest library lives, and where the host uploads the patched copy for libfix.sh.
+	GuestPath  = "/system/lib64/libndk_translation.so"
+	UploadPath = "/data/local/tmp/ndkfix-upload.so"
+	// File name of the cached patched library in <root>\guest-patches and in the guest's /data/local/tmp. A new patch
+	// gets a new name.
+	CacheName = "libndk_translation.hintnop1.so"
+)
+
+// nop6 is nopw 0x0(%rax,%rax,1), the length of a jbe rel32.
+var nop6 = mustHex("66 0f 1f 44 00 00")
+
+// site is one decoder's HINT block: from `and $0xfc0` (CRm:op2 >> 1) through the jmp to the NOP path.
+type site struct {
+	name  string
+	va    int    // virtual address of the block
+	block []byte // its bytes in the image's library
+	jbe   int    // offset of the `jbe UndefinedInsn` in block
+}
+
+var sites = []site{
+	{"Decoder<SemanticsPlayer<HeavyOptimizerFrontend>>::DecodeSystemClass", 0xd9a96,
+		mustHex("89 c1 81 e1 c0 0f 00 00 81 f9 bf 00 00 00 0f 87 c2 01 00 00 c1 e8 05 83 e0 7e 83 c0 fe" +
+			" 83 f8 03 0f 86 42 01 00 00 e9 ab 01 00 00"), 32},
+	{"Decoder<SemanticsPlayer<LightTranslator>>::DecodeSystemClass", 0x140744,
+		mustHex("89 c1 81 e1 c0 0f 00 00 81 f9 bf 00 00 00 0f 87 ad 01 00 00 c1 e8 05 83 e0 7e 83 c0 fe" +
+			" 83 f8 03 0f 86 33 01 00 00 e9 96 01 00 00"), 32},
+	{"InterpretInsn（内联的 Decoder<SemanticsPlayer<Interpreter>>::DecodeSystemClass）", 0x1d44ca,
+		mustHex("89 d8 25 c0 0f 00 00 3d bf 00 00 00 0f 87 14 14 00 00 c1 eb 05 83 e3 7e 83 c3 fe 83 fb 03" +
+			" 0f 86 f5 13 00 00 e9 fd 13 00 00"), 30},
+}
+
+// mustHex is bytes.fromhex: whitespace between the byte pairs is ignored.
+func mustHex(s string) []byte {
+	b, err := hex.DecodeString(strings.Join(strings.Fields(s), ""))
+	if err != nil {
+		panic("ndkfix: bad hex constant " + s)
+	}
+	return b
+}
+
+func SHA256Hex(b []byte) string {
+	sum := sha256.Sum256(b)
+	return hex.EncodeToString(sum[:])
+}
+
+// Patch returns the patched library. errs.Unsupported when the input's hash, any original byte sequence, a branch
+// target or the result's hash does not match; the input is never changed.
+func Patch(original []byte) ([]byte, error) {
+	if digest := SHA256Hex(original); digest != OrigSHA256 {
+		return nil, errs.Newf(errs.Unsupported, "ARM 转译层库 sha256 %s 不是预期版本", digest)
+	}
+	data := bytes.Clone(original)
+	if err := apply(data); err != nil {
+		return nil, err
+	}
+	if digest := SHA256Hex(data); digest != FixSHA256 {
+		return nil, errs.Newf(errs.Unsupported, "改完的 ARM 转译层库 sha256 %s 不是预期值", digest)
+	}
+	return data, nil
+}
+
+// apply checks every site of data against the image's bytes and replaces its jbe with nop6. Nothing is written
+// unless all sites check out.
+func apply(data []byte) error {
+	offs := make([]int, len(sites))
+	for k, s := range sites {
+		off, err := fileOffset(data, s.va, len(s.block))
+		if err != nil {
+			return errs.Newf(errs.Unsupported, "%s（0x%x）: %v", s.name, s.va, err)
+		}
+		if got := data[off : off+len(s.block)]; !bytes.Equal(got, s.block) {
+			return errs.Newf(errs.Unsupported, "%s（0x%x）原字节不符: %s", s.name, s.va, hex.EncodeToString(got))
+		}
+		// The jmp the four hints fall through to after the edit must be the NOP path, where the ja of CRm:op2 >= 6 goes.
+		ja, jmp, err := s.targets()
+		if err != nil {
+			return err
+		}
+		if ja != jmp {
+			return errs.Newf(errs.Unsupported, "%s（0x%x）: 落下去的 jmp 去 0x%x，不是 NOP 出口 0x%x", s.name, s.va, jmp, ja)
+		}
+		offs[k] = off
+	}
+	for k, s := range sites {
+		copy(data[offs[k]+s.jbe:], nop6)
+	}
+	return nil
+}
+
+// targets reads the block's branches: where the ja (CRm:op2 >= 6) and the jmp after the jbe go.
+func (s site) targets() (ja, jmp int, err error) {
+	at := bytes.Index(s.block, []byte{0x0f, 0x87})
+	if at < 0 || at+6 > s.jbe || !bytes.HasPrefix(s.block[s.jbe:], []byte{0x0f, 0x86}) ||
+		len(s.block) != s.jbe+6+5 || s.block[s.jbe+6] != 0xe9 {
+		return 0, 0, errs.Newf(errs.Unsupported, "%s: 补丁点的指令不是 ja / jbe / jmp", s.name)
+	}
+	rel := func(p int) int { return int(int32(binary.LittleEndian.Uint32(s.block[p:]))) }
+	ja = s.va + at + 6 + rel(at+2)
+	jmp = s.va + s.jbe + 6 + 5 + rel(s.jbe+7)
+	return ja, jmp, nil
+}
+
+// fileOffset maps the virtual address range [va, va+n) to a file offset through the executable PT_LOAD that holds
+// it in the file.
+func fileOffset(data []byte, va, n int) (int, error) {
+	f, err := elf.NewFile(bytes.NewReader(data))
+	if err != nil {
+		return 0, err
+	}
+	for _, p := range f.Progs {
+		if p.Type != elf.PT_LOAD || p.Flags&elf.PF_X == 0 {
+			continue
+		}
+		start, end := p.Vaddr, p.Vaddr+p.Filesz
+		if uint64(va) >= start && uint64(va+n) <= end {
+			off := int(p.Off + uint64(va) - start)
+			if off < 0 || off+n > len(data) {
+				break
+			}
+			return off, nil
+		}
+	}
+	return 0, errs.Newf(errs.Unsupported, "不在可执行段里")
+}
diff --git a/internal/ndkfix/ndkfix_test.go b/internal/ndkfix/ndkfix_test.go
new file mode 100644
index 0000000..70634f0
--- /dev/null
+++ b/internal/ndkfix/ndkfix_test.go
@@ -0,0 +1,267 @@
+package ndkfix
+
+import (
+	"bytes"
+	"debug/elf"
+	"encoding/binary"
+	"encoding/hex"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"modavd/internal/errs"
+)
+
+// The real libraries (read-only) in $MODAVD_TEST_NDKLIBS: the image's libndk_translation.so and the patched copy,
+// libndk_translation.hintnop1.so (the Python reference make_sevl_patch.py made it). Copies of the image's file, never
+// a production root. The tests that need them are skipped when they are absent.
+var (
+	origLib = filepath.Join(os.Getenv("MODAVD_TEST_NDKLIBS"), "libndk_translation.so")
+	fixLib  = filepath.Join(os.Getenv("MODAVD_TEST_NDKLIBS"), CacheName)
+)
+
+func readOrSkip(t *testing.T, path string) []byte {
+	t.Helper()
+	b, err := os.ReadFile(path)
+	if os.IsNotExist(err) {
+		t.Skipf("%s 不存在", path)
+	}
+	if err != nil {
+		t.Fatal(err)
+	}
+	return b
+}
+
+// jbeRanges are the file ranges Patch may change: the jbe of each site.
+func jbeRanges(t *testing.T, data []byte) [][2]int {
+	t.Helper()
+	var r [][2]int
+	for _, s := range sites {
+		off, err := fileOffset(data, s.va, len(s.block))
+		if err != nil {
+			t.Fatal(err)
+		}
+		r = append(r, [2]int{off + s.jbe, off + s.jbe + 6})
+	}
+	return r
+}
+
+func buildID(t *testing.T, data []byte) string {
+	t.Helper()
+	f, err := elf.NewFile(bytes.NewReader(data))
+	if err != nil {
+		t.Fatal(err)
+	}
+	sec := f.Section(".note.gnu.build-id")
+	if sec == nil {
+		t.Fatal("no .note.gnu.build-id")
+	}
+	b, err := sec.Data()
+	if err != nil || len(b) < 16+16 {
+		t.Fatalf("build-id note: %d bytes, %v", len(b), err)
+	}
+	return hex.EncodeToString(b[16:32]) // namesz, descsz, type, "GNU\0", then the 16-byte id
+}
+
+func TestPatchRealLibrary(t *testing.T) {
+	orig := readOrSkip(t, origLib)
+	want := readOrSkip(t, fixLib)
+	if got := SHA256Hex(orig); got != OrigSHA256 {
+		t.Fatalf("original sha256 %s, want %s", got, OrigSHA256)
+	}
+	keep := bytes.Clone(orig)
+	got, err := Patch(orig)
+	if err != nil {
+		t.Fatalf("Patch: %v", err)
+	}
+	if !bytes.Equal(orig, keep) {
+		t.Fatal("Patch modified its input")
+	}
+	if SHA256Hex(got) != FixSHA256 || !bytes.Equal(got, want) {
+		t.Fatalf("patched sha256 %s, want %s (the file in %s)", SHA256Hex(got), FixSHA256, fixLib)
+	}
+	// Same size, and every changed byte inside a declared jbe: build-id, dynamic symbols, GOT and data untouched.
+	if len(got) != len(orig) {
+		t.Fatalf("size %d, want %d", len(got), len(orig))
+	}
+	ranges := jbeRanges(t, orig)
+	changed := 0
+	for k := range orig {
+		if orig[k] == got[k] {
+			continue
+		}
+		changed++
+		inside := false
+		for _, r := range ranges {
+			inside = inside || r[0] <= k && k < r[1]
+		}
+		if !inside {
+			t.Errorf("byte 0x%x changed outside the patch sites", k)
+		}
+	}
+	if changed != 12 { // 3 x (0f 86 xx xx 00 00 -> 66 0f 1f 44 00 00): the last two bytes stay
+		t.Errorf("%d bytes changed, want 12", changed)
+	}
+	if a, b := buildID(t, orig), buildID(t, got); a != BuildID || b != BuildID {
+		t.Errorf("build-id %s -> %s, want %s", a, b, BuildID)
+	}
+	// textDelta as the vkfix port writes it would be VA - 0x1000 here: check the PT_LOAD mapping says the same.
+	for _, s := range sites {
+		if off, _ := fileOffset(orig, s.va, len(s.block)); off != s.va-0x1000 {
+			t.Errorf("%s: file offset 0x%x, want 0x%x", s.name, off, s.va-0x1000)
+		}
+	}
+	// For the cross-check against the Python reference: dump the result where asked.
+	if out := os.Getenv("MODAVD_NDKFIX_DUMP"); out != "" {
+		if err := os.WriteFile(out, got, 0o644); err != nil {
+			t.Fatal(err)
+		}
+	}
+}
+
+// TestPatchWrongInput: anything but the image's library is refused before a byte is changed, the already patched
+// library included.
+func TestPatchWrongInput(t *testing.T) {
+	cases := map[string][]byte{"empty": nil, "junk": []byte("x"), "elf": synthetic(t)}
+	if orig, err := os.ReadFile(origLib); err == nil {
+		flipped := bytes.Clone(orig)
+		flipped[len(flipped)/2] ^= 0xff
+		cases["flipped"] = flipped
+		if fix, err := os.ReadFile(fixLib); err == nil {
+			cases["patched"] = fix
+		}
+	}
+	for name, in := range cases {
+		keep := bytes.Clone(in)
+		out, err := Patch(in)
+		if out != nil || errs.CodeOf(err) != errs.Unsupported {
+			t.Errorf("%s: got %v, %v; want unsupported", name, out != nil, err)
+			continue
+		}
+		if want := "ARM 转译层库 sha256 " + SHA256Hex(in) + " 不是预期版本"; err.Error() != want {
+			t.Errorf("%s: message %q, want %q", name, err.Error(), want)
+		}
+		if !bytes.Equal(in, keep) {
+			t.Errorf("%s: input changed", name)
+		}
+	}
+}
+
+// synthetic is an ELF with the library's executable PT_LOAD (file 0xc74c0, VA 0xc84c0) holding the three blocks
+// where the image's library has them, and zeros elsewhere.
+func synthetic(t *testing.T) []byte {
+	t.Helper()
+	const off, va, size = 0xc74c0, 0xc84c0, 0x14de30
+	data := make([]byte, off+size)
+	copy(data, []byte{0x7f, 'E', 'L', 'F', 2, 1, 1})
+	le := binary.LittleEndian
+	le.PutUint16(data[16:], 3)  // ET_DYN
+	le.PutUint16(data[18:], 62) // EM_X86_64
+	le.PutUint32(data[20:], 1)
+	le.PutUint64(data[32:], 64) // e_phoff
+	le.PutUint16(data[52:], 64) // e_ehsize
+	le.PutUint16(data[54:], 56) // e_phentsize
+	le.PutUint16(data[56:], 1)  // e_phnum
+	le.PutUint16(data[58:], 64) // e_shentsize
+	ph := data[64:]
+	le.PutUint32(ph[0:], uint32(elf.PT_LOAD))
+	le.PutUint32(ph[4:], uint32(elf.PF_R|elf.PF_X))
+	le.PutUint64(ph[8:], off)
+	le.PutUint64(ph[16:], va)
+	le.PutUint64(ph[24:], va)
+	le.PutUint64(ph[32:], size)
+	le.PutUint64(ph[40:], size)
+	le.PutUint64(ph[48:], 0x1000)
+	for _, s := range sites {
+		copy(data[s.va-va+off:], s.block)
+	}
+	return data
+}
+
+// TestApply: on the library's layout exactly the three jbe become nop6, the rest of each block stays.
+func TestApply(t *testing.T) {
+	data := synthetic(t)
+	before := bytes.Clone(data)
+	if err := apply(data); err != nil {
+		t.Fatal(err)
+	}
+	for _, s := range sites {
+		off := s.va - 0x1000
+		want := bytes.Clone(s.block)
+		copy(want[s.jbe:], nop6)
+		if got := data[off : off+len(s.block)]; !bytes.Equal(got, want) {
+			t.Errorf("%s: %x, want %x", s.name, got, want)
+		}
+		copy(data[off:], s.block) // back to the original for the comparison below
+	}
+	if !bytes.Equal(data, before) {
+		t.Error("bytes changed outside the blocks")
+	}
+}
+
+// TestApplyRefuses: one byte off in any block, or a block outside the executable segment, changes nothing at all.
+func TestApplyRefuses(t *testing.T) {
+	for k, s := range sites {
+		data := synthetic(t)
+		data[s.va-0x1000+3] ^= 0x01
+		before := bytes.Clone(data)
+		err := apply(data)
+		if errs.CodeOf(err) != errs.Unsupported || !strings.Contains(err.Error(), "原字节不符") {
+			t.Errorf("site %d: %v", k, err)
+		}
+		if !bytes.Equal(data, before) {
+			t.Errorf("site %d: data changed although a block did not match", k)
+		}
+	}
+	data := synthetic(t)
+	binary.LittleEndian.PutUint32(data[64+4:], uint32(elf.PF_R)) // the segment loses its X
+	if err := apply(data); errs.CodeOf(err) != errs.Unsupported || !strings.Contains(err.Error(), "不在可执行段里") {
+		t.Errorf("non-executable segment: %v", err)
+	}
+	if err := apply([]byte("not an elf")); errs.CodeOf(err) != errs.Unsupported {
+		t.Errorf("not an ELF: %v", err)
+	}
+}
+
+// TestSiteTargets: golden branch targets (llvm-objdump of the image's library). The jmp each jbe falls through to
+// after the edit is the ja target of CRm:op2 >= 6, the NOP path; the jbe went to UndefinedInsn.
+func TestSiteTargets(t *testing.T) {
+	want := []struct{ ja, jbe, jmp int }{
+		{0xd9c6c, 0xd9bfe, 0xd9c6c},
+		{0x140905, 0x14089d, 0x140905},
+		{0x1d58f0, 0x1d58e3, 0x1d58f0},
+	}
+	for k, s := range sites {
+		ja, jmp, err := s.targets()
+		if err != nil {
+			t.Fatal(err)
+		}
+		jbe := s.va + s.jbe + 6 + int(int32(binary.LittleEndian.Uint32(s.block[s.jbe+2:])))
+		if ja != want[k].ja || jbe != want[k].jbe || jmp != want[k].jmp {
+			t.Errorf("%s: ja 0x%x jbe 0x%x jmp 0x%x, want %+v", s.name, ja, jbe, jmp, want[k])
+		}
+	}
+	if got := hex.EncodeToString(nop6); got != "660f1f440000" {
+		t.Errorf("nop6 = %s", got)
+	}
+	// a block whose jmp went elsewhere is refused
+	bad := sites[0]
+	bad.block = bytes.Clone(bad.block)
+	bad.block[len(bad.block)-4]++
+	if ja, jmp, _ := bad.targets(); ja == jmp {
+		t.Error("changed jmp displacement still reads as the NOP path")
+	}
+}
+
+func TestMustHex(t *testing.T) {
+	if got := hex.EncodeToString(mustHex(" 0f 86\t42 01 ")); got != "0f864201" {
+		t.Errorf("mustHex %s", got)
+	}
+	defer func() {
+		if recover() == nil {
+			t.Error("mustHex accepted an odd digit count")
+		}
+	}()
+	mustHex("4")
+}
diff --git a/internal/ui/web/dev/mock.js b/internal/ui/web/dev/mock.js
index a17c7b7..e4e89e0 100644
--- a/internal/ui/web/dev/mock.js
+++ b/internal/ui/web/dev/mock.js
@@ -159,7 +159,7 @@ function setup(sc) {
     s.progress = { step: 'first_boot', message: '实例 1 首次开机初始化', done: 800, total: 1000 };
     Object.assign(one, { status: 'online', booted: true });
     one.screencap.shm_ready = true;
-    setTimeout(() => step(s, 'vulkan_fix', '实例 1 客体 Vulkan 驱动补丁', 900), 9000);
+    setTimeout(() => step(s, 'vulkan_fix', '实例 1 客体库补丁（Vulkan 驱动、ARM 转译层）', 900), 9000);
     setTimeout(() => {
       Object.assign(one, { busy: '', initialized: true, launcher: 'µLauncher', renderer: GPU });
       finishJob(s, startResult(one, 26.3, 58.1, true));
@@ -502,7 +502,7 @@ function startSeq(inst, j, window) {
     steps.push([900, () => step(j, 'first_boot', `实例 ${i} 首次开机初始化`, 800)]);
     steps.push([3200, () => {
       Object.assign(inst, { initialized: true, launcher: 'µLauncher', renderer: GPU });
-      step(j, 'vulkan_fix', `实例 ${i} 客体 Vulkan 驱动补丁`, 900);
+      step(j, 'vulkan_fix', `实例 ${i} 客体库补丁（Vulkan 驱动、ARM 转译层）`, 900);
     }]);
   }
   steps.push([800, () => {
diff --git a/internal/ui/web/js/panels.js b/internal/ui/web/js/panels.js
index af3f553..cb922f1 100644
--- a/internal/ui/web/js/panels.js
+++ b/internal/ui/web/js/panels.js
@@ -410,5 +410,5 @@ function resultText(j) {
   if (j.kind.startsWith('playstore-')) return playStoreText(j.kind, r);
   if (!r.launched) return '模拟器本来就在运行，只重做了开机后的设置。';
   return [`安卓开机 ${dur(r.boot_seconds || 0)}，共 ${dur(r.total_seconds || 0)}`, r.first_boot && '完成了首次初始化',
-    r.zygote_restarted && '装了 Vulkan 补丁（安卓框架重启过一次）'].filter(Boolean).join('，') + '。';
+    r.zygote_restarted && '挂了客体库补丁（安卓框架重启过一次）'].filter(Boolean).join('，') + '。';
 }
diff --git a/internal/vkfix/profile.go b/internal/vkfix/profile.go
deleted file mode 100644
index ed3aef9..0000000
--- a/internal/vkfix/profile.go
+++ /dev/null
@@ -1,27 +0,0 @@
-package vkfix
-
-// Profile keeps a verified guest library's byte contract together. An ABI alone
-// does not make a different Android release compatible with a binary patch.
-type Profile struct {
-	OrigSHA256 string
-	FixSHA256  string
-	CacheName  string
-	Patch      func([]byte) ([]byte, error)
-}
-
-func X86Profile() Profile {
-	return Profile{OrigSHA256: OrigSHA256, FixSHA256: FixSHA256, CacheName: CacheName, Patch: Patch}
-}
-
-// ForABI selects a patch contract for the instance's guest ABI, independently
-// of the manager's host architecture. Only the API34 x86_64 patch is verified.
-// The Mac API35 image has no /vendor/lib64/libvulkan_enc.so; its different Vulkan
-// HAL must not inherit either the retired API34 ARM64 edits or the x86 patch.
-func ForABI(abi string) (Profile, bool) {
-	switch abi {
-	case "x86_64":
-		return X86Profile(), true
-	default:
-		return Profile{}, false
-	}
-}