diff --git a/.github/release-notes/versions/1.8.3.md b/.github/release-notes/versions/1.8.3.md
new file mode 100644
index 0000000..2768829
--- /dev/null
+++ b/.github/release-notes/versions/1.8.3.md
@@ -0,0 +1,12 @@
+### PVM2 引用与短方法兼容修复
+
+- 修复独立方法因对象、数组参数被过度排除的问题。符合条件的引用透传、空值判断和引用身份比较可继续进入 PVM2 转换与产物核验。
+- 修复单条 `return` 方法被旧式原地回填长度检查拦截的问题，覆盖对象、数组和基本类型/宽值参数透传；PVM2 仍须通过完整跳板及加密镜像验证。
+- 细分继承/接口虚方法契约、同步、异常处理区及指令限制，避免把所有兼容排除都显示为生命周期问题。零转换、必保方法未覆盖仍明确失败，跳过项仍计入完整覆盖率。
+- 修复 APK、AAB 和签名任务失败后仍显示“执行中”的进度标题，补齐结束计时和失败步骤标记；明确基础预检通过不代表方法覆盖已通过。
+
+### 验证与使用说明
+
+- 已完成自建 APK 的加固、签名和产物复核，以及生产 Native 解释器三种 ISA 下 666 次引用语义检查。旧版为零转换的引用样本在修复后验证了 18/21 个方法，3 个构造器明确保留；继承契约负例仍正确失败。
+- 本次未新增 Android 真机回归，宿主 JVM/JNI 测试不能代替 ART 真机验收。没有客户 APK 和方法体时，不能据此保证其具体方法全部兼容。
+- 升级后需要重新加固，已有 APK 不会自动获得本次修复。逐方法报告包含业务标识，分享前请手动脱敏。
diff --git a/Cargo.lock b/Cargo.lock
index 75aa77c..1f00c7f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2201,7 +2201,7 @@ dependencies = [
 
 [[package]]
 name = "mocika-shield"
-version = "1.8.2"
+version = "1.8.3"
 dependencies = [
  "dunce",
  "reqwest 0.12.28",
@@ -2229,7 +2229,7 @@ dependencies = [
 
 [[package]]
 name = "mocikashield"
-version = "1.8.2"
+version = "1.8.3"
 dependencies = [
  "cc",
  "chacha20poly1305",
@@ -3635,7 +3635,7 @@ dependencies = [
 
 [[package]]
 name = "shield-cli"
-version = "1.8.2"
+version = "1.8.3"
 dependencies = [
  "anyhow",
  "clap",
@@ -3653,7 +3653,7 @@ dependencies = [
 
 [[package]]
 name = "shield-core"
-version = "1.8.2"
+version = "1.8.3"
 dependencies = [
  "anyhow",
  "chacha20poly1305",
diff --git a/apps/shield-cli/Cargo.toml b/apps/shield-cli/Cargo.toml
index beb2cfd..665a553 100644
--- a/apps/shield-cli/Cargo.toml
+++ b/apps/shield-cli/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "shield-cli"
-version = "1.8.2"
+version = "1.8.3"
 edition = "2021"
 authors = ["MocikaDev"]
 license = "MIT OR Apache-2.0"
diff --git a/apps/shield-gui/package-lock.json b/apps/shield-gui/package-lock.json
index 16d9e21..156a019 100644
--- a/apps/shield-gui/package-lock.json
+++ b/apps/shield-gui/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "mocika-shield-gui",
-  "version": "1.8.2",
+  "version": "1.8.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "mocika-shield-gui",
-      "version": "1.8.2",
+      "version": "1.8.3",
       "license": "MIT OR Apache-2.0",
       "dependencies": {
         "@radix-ui/react-dialog": "^1.1.19",
diff --git a/apps/shield-gui/package.json b/apps/shield-gui/package.json
index dc7867a..40b524f 100644
--- a/apps/shield-gui/package.json
+++ b/apps/shield-gui/package.json
@@ -1,6 +1,6 @@
 {
   "name": "mocika-shield-gui",
-  "version": "1.8.2",
+  "version": "1.8.3",
   "license": "MIT OR Apache-2.0",
   "private": true,
   "type": "module",
diff --git a/apps/shield-gui/src-tauri/Cargo.toml b/apps/shield-gui/src-tauri/Cargo.toml
index 62104a0..66a7cd9 100644
--- a/apps/shield-gui/src-tauri/Cargo.toml
+++ b/apps/shield-gui/src-tauri/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "mocika-shield"
-version = "1.8.2"
+version = "1.8.3"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 publish = false
diff --git a/apps/shield-gui/src-tauri/tauri.conf.json b/apps/shield-gui/src-tauri/tauri.conf.json
index a01932a..99bc4ba 100644
--- a/apps/shield-gui/src-tauri/tauri.conf.json
+++ b/apps/shield-gui/src-tauri/tauri.conf.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Shellsmith",
-  "version": "1.8.2",
+  "version": "1.8.3",
   "identifier": "dev.mocika.shield-gui",
   "build": {
     "beforeDevCommand": "npm run dev -- --host 127.0.0.1",
diff --git a/apps/shield-gui/src/components/app/protect-progress-panel.tsx b/apps/shield-gui/src/components/app/protect-progress-panel.tsx
index 08b947d..ddc31fa 100644
--- a/apps/shield-gui/src/components/app/protect-progress-panel.tsx
+++ b/apps/shield-gui/src/components/app/protect-progress-panel.tsx
@@ -1,5 +1,5 @@
 import { useEffect, useState } from "react";
-import { Check, Loader2 } from "lucide-react";
+import { Check, CircleX, Loader2 } from "lucide-react";
 import { stepLabels } from "@/components/app/branding";
 import { t, type Locale } from "@/lib/i18n";
 
@@ -24,10 +24,10 @@ export function ProtectProgressPanel({
 }) {
   const [tick, refresh] = useState(0);
   useEffect(() => {
-    if (!startedAt || finishedAt) return;
+    if (state !== "running" || !startedAt || finishedAt) return;
     const timer = window.setInterval(() => refresh((value) => value + 1), 1000);
     return () => window.clearInterval(timer);
-  }, [finishedAt, startedAt]);
+  }, [state, finishedAt, startedAt]);
   const currentIndex = steps.indexOf(currentStep);
   const percent = state === "done" ? 100 : currentIndex < 0 ? 0 : Math.min(99, Math.round(((currentIndex + 0.5) / steps.length) * 100));
   const elapsed = (() => {
@@ -39,7 +39,7 @@ export function ProtectProgressPanel({
   return (
     <aside className="rounded-[14px] border bg-card p-4">
       <div className="mb-3 flex items-center justify-between gap-3">
-        <h2 className="text-sm font-semibold">{showProgress ? t(locale, "running") : t(locale, "ready")}</h2>
+        <h2 className="text-sm font-semibold" aria-live="polite">{t(locale, state === "failed" || state === "done" || state === "running" ? state : "ready")}</h2>
         {showProgress && <span className="text-xs tabular-nums text-muted-foreground">{percent}%{elapsed ? ` · ${elapsed}` : ""}</span>}
       </div>
       <div className="mb-4 h-2 overflow-hidden rounded-full bg-muted"><div className="h-full rounded-full bg-primary transition-[width]" style={{ width: `${percent}%` }} /></div>
@@ -51,7 +51,9 @@ export function ProtectProgressPanel({
       <div className="space-y-2">
         {steps.map((step) => (
           <div key={step} className="flex items-center gap-2 rounded-md px-2 py-1.5">
-            {currentStep === step && state === "running" ? (
+            {currentStep === step && state === "failed" ? (
+              <CircleX className="h-4 w-4 text-destructive" aria-label={t(locale, "failed")} />
+            ) : currentStep === step && state === "running" ? (
               <Loader2 className="h-4 w-4 animate-spin text-primary" />
             ) : steps.indexOf(step) < steps.indexOf(currentStep) || state === "done" ? (
               <Check className="h-4 w-4 text-success" />
diff --git a/apps/shield-gui/src/hooks/use-about-page.ts b/apps/shield-gui/src/hooks/use-about-page.ts
index 0f0a30d..5fd114e 100644
--- a/apps/shield-gui/src/hooks/use-about-page.ts
+++ b/apps/shield-gui/src/hooks/use-about-page.ts
@@ -9,7 +9,7 @@ type AppInfo = {
 };
 
 const defaultAppInfo: AppInfo = {
-  version: "1.8.2",
+  version: "1.8.3",
   git_hash: "dev",
   build_date: "unknown",
 };
diff --git a/apps/shield-gui/src/hooks/use-protect-workflow.ts b/apps/shield-gui/src/hooks/use-protect-workflow.ts
index 634e9e7..12ff158 100644
--- a/apps/shield-gui/src/hooks/use-protect-workflow.ts
+++ b/apps/shield-gui/src/hooks/use-protect-workflow.ts
@@ -333,6 +333,7 @@ export function useProtectWorkflow({
       notifySuccess(t(locale, "protectCompleted"));
     } catch (err) {
       const message = String(err);
+      setFinishedAt((previous) => previous ?? Date.now());
       setError(message);
       notifyError(message);
       setState("failed");
diff --git a/apps/shield-gui/src/hooks/use-sign-workflow.ts b/apps/shield-gui/src/hooks/use-sign-workflow.ts
index 877a256..0f3145d 100644
--- a/apps/shield-gui/src/hooks/use-sign-workflow.ts
+++ b/apps/shield-gui/src/hooks/use-sign-workflow.ts
@@ -126,10 +126,12 @@ export function useSignWorkflow({
         sharing: sharingChoice,
       });
       await api.deleteFile(`${outputPath}.idsig`).catch(() => undefined);
+      setFinishedAt((previous) => previous ?? Date.now());
       setState("done");
       notifySuccess(t(locale, "signDone"));
     } catch (err) {
       const message = String(err);
+      setFinishedAt((previous) => previous ?? Date.now());
       setError(message);
       notifyError(message);
       setState("failed");
diff --git a/apps/shield-gui/src/lib/i18n.ts b/apps/shield-gui/src/lib/i18n.ts
index 746370a..b0d171c 100644
--- a/apps/shield-gui/src/lib/i18n.ts
+++ b/apps/shield-gui/src/lib/i18n.ts
@@ -197,7 +197,7 @@ const dict = {
     preflightReady: "预检通过",
     preflightWarning: "存在兼容风险",
     preflightBlocked: "当前不能加固",
-    preflightReadyHint: "当前设置满足已验证的加固条件。",
+    preflightReadyHint: "基础环境与输入检查已通过；方法可转换性和实际覆盖范围将在加固时验证。",
     preflightWarningHint: "可以继续，但请确认下列风险符合目标设备范围。",
     preflightBlockedHint: "请先处理阻断项或调整本次加固设置。",
     preflightViewDetails: "查看详情（{count} 项）",
@@ -651,7 +651,7 @@ const dict = {
     preflightReady: "Preflight passed",
     preflightWarning: "Compatibility risks found",
     preflightBlocked: "Protection is blocked",
-    preflightReadyHint: "The current settings meet the verified protection requirements.",
+    preflightReadyHint: "Environment and input checks passed; method eligibility and coverage will be verified during protection.",
     preflightWarningHint: "You may continue after confirming the risks match your target devices.",
     preflightBlockedHint: "Resolve the blocking items or adjust the protection settings first.",
     preflightViewDetails: "View details ({count})",
diff --git a/apps/shield-gui/src/lib/protect-diagnostic.ts b/apps/shield-gui/src/lib/protect-diagnostic.ts
index 50a13d1..8ab5bbe 100644
--- a/apps/shield-gui/src/lib/protect-diagnostic.ts
+++ b/apps/shield-gui/src/lib/protect-diagnostic.ts
@@ -52,10 +52,14 @@ export function buildPvm2FailureDiagnostic(summary: Pvm2FailureSummary, locale:
   const labels: Record<keyof Pvm2FailureSummary["reasons"], [string, string]> = {
     no_code: ["无 DEX 方法体（Native/抽象方法）", "No DEX body (native/abstract)"],
     initializer: ["构造器/静态初始化器", "Initializer"],
-    ui_runtime_glue: ["界面/生命周期兼容规则", "UI/lifecycle compatibility"],
+    ui_runtime_glue: ["界面范围兼容规则（未细分）", "UI scope compatibility (unspecified)"],
     data_resource_runtime_glue: ["数据/资源框架兼容规则", "Data/resource compatibility"],
     compiler_generated_bridge: ["编译器生成桥接/合成方法", "Compiler-generated bridge/synthetic method"],
     playback_compatibility: ["媒体/辅助类兼容规则", "Media/helper compatibility"],
+    compatibility_virtual_contract: ["兼容范围：继承/接口虚方法契约未验证", "Compatibility: unverified inherited/interface contract"],
+    compatibility_synchronization: ["兼容范围：同步方法", "Compatibility: synchronized method"],
+    compatibility_exception_region: ["兼容范围：含异常处理区", "Compatibility: exception region"],
+    compatibility_non_leaf_instruction: ["兼容范围：含叶子方法白名单之外的指令", "Compatibility: instruction outside the leaf allowlist"],
     nullable_receiver: ["接收者非空语义无法证明", "Nullable receiver"],
     unsupported_opcode: ["不支持的指令", "Unsupported opcode"],
     register_limit: ["寄存器超限", "Register limit"],
diff --git a/apps/shield-gui/src/lib/tauri.ts b/apps/shield-gui/src/lib/tauri.ts
index 86b46f7..70d55fd 100644
--- a/apps/shield-gui/src/lib/tauri.ts
+++ b/apps/shield-gui/src/lib/tauri.ts
@@ -343,7 +343,7 @@ export type TaskSnapshot = {
 export type Pvm2FailureSummary = {
   selected_classes: number;
   selected_methods: number;
-  reasons: Partial<Record<"no_code" | "initializer" | "ui_runtime_glue" | "data_resource_runtime_glue" | "compiler_generated_bridge" | "playback_compatibility" | "nullable_receiver" | "unsupported_opcode" | "register_limit" | "code_size_limit" | "exception_mapping" | "control_flow" | "type" | "not_attempted" | "other", number>>;
+  reasons: Partial<Record<"no_code" | "initializer" | "ui_runtime_glue" | "data_resource_runtime_glue" | "compiler_generated_bridge" | "playback_compatibility" | "compatibility_virtual_contract" | "compatibility_synchronization" | "compatibility_exception_region" | "compatibility_non_leaf_instruction" | "nullable_receiver" | "unsupported_opcode" | "register_limit" | "code_size_limit" | "exception_mapping" | "control_flow" | "type" | "not_attempted" | "other", number>>;
 };
 
 export type DragDropPayload = {
diff --git a/apps/shield-gui/src/pages/aab-protect-page.tsx b/apps/shield-gui/src/pages/aab-protect-page.tsx
index 76caac3..4df74d4 100644
--- a/apps/shield-gui/src/pages/aab-protect-page.tsx
+++ b/apps/shield-gui/src/pages/aab-protect-page.tsx
@@ -229,6 +229,7 @@ export function AabProtectPage({
       notifySuccess(t(locale, "aabProtectCompleted"));
     } catch (cause) {
       const message = String(cause);
+      setFinishedAt((previous) => previous ?? Date.now());
       setError(message);
       setState("failed");
       notifyError(message);
diff --git a/apps/shield-gui/tests/protect-diagnostic.test.mjs b/apps/shield-gui/tests/protect-diagnostic.test.mjs
index 22d3838..5c9ec2b 100644
--- a/apps/shield-gui/tests/protect-diagnostic.test.mjs
+++ b/apps/shield-gui/tests/protect-diagnostic.test.mjs
@@ -46,3 +46,15 @@ test("普通预检不混入上一任务的失败统计", () => {
     xopPvm2Configured: false, currentStep: "", failed: false, pvm2Failure: failure });
   assert.doesNotMatch(text, /PVM2_ZERO_METHODS/);
 });
+
+test("兼容限制按方法实际阻断条件统计，不再全部显示为生命周期", () => {
+  const text = buildPvm2FailureDiagnostic({ selected_classes: 3, selected_methods: 21,
+    reasons: { initializer: 3, compatibility_virtual_contract: 6, compatibility_synchronization: 2,
+      compatibility_exception_region: 3, compatibility_non_leaf_instruction: 7 } }, "zh");
+  assert.match(text, /所选方法数: 21/);
+  assert.match(text, /继承\/接口虚方法契约未验证\): 6/);
+  assert.match(text, /同步方法\): 2/);
+  assert.match(text, /含异常处理区\): 3/);
+  assert.match(text, /白名单之外的指令\): 7/);
+  assert.doesNotMatch(text, /生命周期|统计无效/);
+});
diff --git a/apps/shield-gui/tests/protect-progress.test.mjs b/apps/shield-gui/tests/protect-progress.test.mjs
new file mode 100644
index 0000000..a107a13
--- /dev/null
+++ b/apps/shield-gui/tests/protect-progress.test.mjs
@@ -0,0 +1,27 @@
+import assert from "node:assert/strict";
+import { after, test } from "node:test";
+import { createElement } from "react";
+import { renderToStaticMarkup } from "react-dom/server";
+import { createServer } from "vite";
+
+const server = await createServer({ server: { middlewareMode: true }, appType: "custom" });
+after(() => server.close());
+const { ProtectProgressPanel } = await server.ssrLoadModule("/src/components/app/protect-progress-panel.tsx");
+
+test("APK、AAB、签名共享进度组件显示真实终态及失败步骤", () => {
+  for (const currentStep of ["ProcessDex", "SignApk"]) {
+    for (const [state, label] of [["idle", "就绪"], ["running", "执行中"], ["failed", "失败"], ["done", "完成"]]) {
+      const html = renderToStaticMarkup(createElement(ProtectProgressPanel, {
+        locale: "zh", state, currentStep, steps: ["CheckTools", currentStep, "Cleanup"],
+        showProgress: state !== "idle", startedAt: 1000, finishedAt: 86000,
+      }));
+      assert.match(html, new RegExp(`<h2[^>]*>${label}</h2>`));
+      if (state === "failed") {
+        assert.match(html, /aria-label="失败"/);
+        assert.match(html, /1m 25s/);
+        assert.doesNotMatch(html, /animate-spin|执行中/);
+      }
+      if (state === "done") assert.match(html, /100%/);
+    }
+  }
+});
diff --git a/crates/shield-core/Cargo.toml b/crates/shield-core/Cargo.toml
index c0d88fd..087eed4 100644
--- a/crates/shield-core/Cargo.toml
+++ b/crates/shield-core/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "shield-core"
-version = "1.8.2"
+version = "1.8.3"
 edition = "2021"
 authors = ["MocikaDev"]
 license = "MIT OR Apache-2.0"
diff --git a/crates/shield-core/src/protect/xop_pvm2.rs b/crates/shield-core/src/protect/xop_pvm2.rs
index 10d091d..9dd67fa 100644
--- a/crates/shield-core/src/protect/xop_pvm2.rs
+++ b/crates/shield-core/src/protect/xop_pvm2.rs
@@ -1151,7 +1151,7 @@ mod tests {
         );
         for (kind, expected, count) in [
             ("native", Pvm2SkipReason::NoCode, 2),
-            ("ui", Pvm2SkipReason::UiRuntimeGlue, 3),
+            ("ui", Pvm2SkipReason::CompatibilityVirtualContract, 3),
             ("registers", Pvm2SkipReason::RegisterLimit, 3),
         ] {
             let dex = work.path().join(format!("zero-{kind}/dex"));
diff --git a/crates/shield-core/src/protection_report.rs b/crates/shield-core/src/protection_report.rs
index 84826c6..97a471f 100644
--- a/crates/shield-core/src/protection_report.rs
+++ b/crates/shield-core/src/protection_report.rs
@@ -59,6 +59,10 @@ pub enum Pvm2SkipReason {
     DataResourceRuntimeGlue,
     CompilerGeneratedBridge,
     PlaybackCompatibility,
+    CompatibilityVirtualContract,
+    CompatibilitySynchronization,
+    CompatibilityExceptionRegion,
+    CompatibilityNonLeafInstruction,
     NullableReceiver,
     UnsupportedOpcode,
     RegisterLimit,
@@ -72,6 +76,23 @@ pub enum Pvm2SkipReason {
 
 impl Pvm2SkipReason {
     fn classify(reason: &str) -> Self {
+        if let Some((scope, restriction)) = reason.split_once(':') {
+            if matches!(
+                scope,
+                "ui_runtime_glue"
+                    | "data_resource_runtime_glue"
+                    | "playback_compatibility"
+                    | "compiler_generated_bridge"
+            ) {
+                return match restriction {
+                    "virtual_contract" => Self::CompatibilityVirtualContract,
+                    "synchronization" => Self::CompatibilitySynchronization,
+                    "exception_region" => Self::CompatibilityExceptionRegion,
+                    "non_leaf_instruction" => Self::CompatibilityNonLeafInstruction,
+                    _ => Self::Other,
+                };
+            }
+        }
         match reason {
             "no_code" => Self::NoCode,
             "initializer" => Self::Initializer,
@@ -99,10 +120,14 @@ impl Pvm2SkipReason {
         match self {
             Self::NoCode => "无 DEX 方法体（Native/抽象方法）",
             Self::Initializer => "构造器/静态初始化器",
-            Self::UiRuntimeGlue => "界面/生命周期兼容规则",
+            Self::UiRuntimeGlue => "界面范围兼容规则（未细分）",
             Self::DataResourceRuntimeGlue => "数据/资源框架兼容规则",
             Self::CompilerGeneratedBridge => "编译器生成桥接/合成方法",
             Self::PlaybackCompatibility => "媒体/辅助类兼容规则",
+            Self::CompatibilityVirtualContract => "兼容范围：继承/接口虚方法契约未验证",
+            Self::CompatibilitySynchronization => "兼容范围：同步方法",
+            Self::CompatibilityExceptionRegion => "兼容范围：含异常处理区",
+            Self::CompatibilityNonLeafInstruction => "兼容范围：含叶子方法白名单之外的指令",
             Self::NullableReceiver => "接收者非空语义无法证明",
             Self::UnsupportedOpcode => "不支持的指令",
             Self::RegisterLimit => "寄存器超限",
@@ -260,9 +285,13 @@ impl std::fmt::Display for Pvm2Failure {
                         | Pvm2SkipReason::DataResourceRuntimeGlue
                         | Pvm2SkipReason::CompilerGeneratedBridge
                         | Pvm2SkipReason::PlaybackCompatibility
+                        | Pvm2SkipReason::CompatibilityVirtualContract
+                        | Pvm2SkipReason::CompatibilitySynchronization
+                        | Pvm2SkipReason::CompatibilityExceptionRegion
+                        | Pvm2SkipReason::CompatibilityNonLeafInstruction
                 )
             }) {
-                write!(f, "\n部分方法被兼容规则排除，请根据本地报告确认要保护的业务范围；不应强行绕过兼容检查。")?;
+                write!(f, "\n兼容分类表示当前准入限制，不代表这些方法都是生命周期回调。仅修改类前缀或降低保护级别不能证明这些方法已获 PVM2 保护；可将独立业务逻辑提取到普通类，并重新核验逐方法覆盖。")?;
             }
             if self.summary.reasons.keys().any(|r| {
                 matches!(
@@ -714,6 +743,22 @@ mod tests {
         let cases = [
             ("no_code", Pvm2SkipReason::NoCode),
             ("initializer", Pvm2SkipReason::Initializer),
+            (
+                "ui_runtime_glue:virtual_contract",
+                Pvm2SkipReason::CompatibilityVirtualContract,
+            ),
+            (
+                "data_resource_runtime_glue:synchronization",
+                Pvm2SkipReason::CompatibilitySynchronization,
+            ),
+            (
+                "playback_compatibility:exception_region",
+                Pvm2SkipReason::CompatibilityExceptionRegion,
+            ),
+            (
+                "ui_runtime_glue:non_leaf_instruction",
+                Pvm2SkipReason::CompatibilityNonLeafInstruction,
+            ),
             ("ui_runtime_glue", Pvm2SkipReason::UiRuntimeGlue),
             (
                 "data_resource_runtime_glue",
diff --git a/docs/usage.md b/docs/usage.md
index 926f34d..ef5646f 100644
--- a/docs/usage.md
+++ b/docs/usage.md
@@ -543,10 +543,14 @@ shield protect --input input.apk --output protected.apk \
 
 启用 PVM2 的成功输出旁会生成 `protected.apk.protection.json` 或 `protected.aab.protection.json`。统计分别展示转换成功率、选中方法覆盖率、原始指令字节覆盖率和必保方法覆盖率；未声明必保方法时该指标为 `null`，不记为 100%。这些百分比仅针对选择范围，不代表整个应用。报告包含逐方法原因、最终索引与产物摘要，不包含密钥或明文镜像，也不进入安装包。
 
-选择范围在兼容性过滤**之前**统计。UI/导航、数据/资源辅助和媒体命名不再直接排除整类：没有对象/数组参数、对象状态访问、外部调用、同步或异常处理的基本类型计算方法，可以继续进入 PVM2 指令与产物检查。私有和静态方法可在框架类中单独转换；其它实例方法仅在直接继承 `Object`、不实现接口且不覆盖 `hashCode/finalize` 契约时适用此放行规则。分支、循环和数值运算仍须通过现有编译器检查，不能只凭命名认定可转换。
+选择范围在兼容性过滤**之前**统计。UI/导航、数据/资源辅助和媒体命名不再直接排除整类：没有对象状态访问、外部调用、同步或异常处理的独立方法，可以继续进入 PVM2 指令与产物检查。支持基本类型计算，以及对象/数组参数未使用、引用透传、空值分支和引用身份比较；引用参数不会再仅因其类型被排除，但数组元素和字段访问仍不在这一兼容放行范围内。私有和静态方法可在框架类中单独转换；其它实例方法仅在直接继承 `Object`、不实现接口且不覆盖 `hashCode/finalize` 契约时适用此放行规则。分支、循环和数值运算仍须通过现有编译器检查，不能只凭命名认定可转换。
 
 构造器、静态初始化器、生成桥接/合成方法和仍涉及框架状态的候选保持原兼容边界；未解析的外部或跨 DEX 继承契约不据此扩大虚方法范围。跳过项仍计入覆盖率分母，并保留 `ui_runtime_glue`、`compiler_generated_bridge`、`data_resource_runtime_glue` 或 `playback_compatibility` 等实际分类。精确必保清单同样受方法兼容检查约束，必保项被排除时任务失败，不会自动降级。所有候选都不可转换时仍返回 `PVM2_ZERO_METHODS`，不会把零转换记为成功。这些规则不代表已识别应用全部关键业务；完整覆盖率需用新打包器重新生成。
 
+兼容排除的本地原因带有首个阻断条件，例如 `ui_runtime_glue:virtual_contract`；脱敏摘要分别统计继承/接口虚方法契约未验证、同步方法、异常处理区及叶子方法白名单之外的指令。它们表示准入限制，不能据此认定方法一定是生命周期回调。旧报告没有细分信息时仍按原分类展示，不能反推具体方法体。基础预检通过也不代表 PVM2 方法覆盖已经通过。
+
+只有一条 `return` 的参数透传方法同样可转换，包括对象、数组及基本类型/宽值。PVM2 重建完整方法体，不再沿用旧式原地回填的最小字节数限制；最终跳板与加密镜像仍必须通过产物校验。
+
 严格模式的 70% 转换成功率门槛保持原口径：类兼容预筛排除项不算编译尝试，媒体准入失败仍计入。该指标与完整选择范围覆盖率分别报告；例如 1 个计算方法转换、1 个界面回调保留时，转换成功率可以为 100%，选中方法覆盖率仍只有 50%。
 
 使用 `shield sign` 或 GUI 自动签名时，公共签名流程会重新比对 DEX 并更新最终文件摘要。另用外部签名工具会改变文件摘要，原报告不再对应签名后的文件。报告为本地构建记录，不是不可伪造的安全认证。新能力要求从当前源码重建的 Packer（`make build-pvm2`），旧 JAR 即使镜像版本相同也会被明确拒绝。
diff --git a/shield-stub/compat/api19-rust/Cargo.lock b/shield-stub/compat/api19-rust/Cargo.lock
index 605f2be..c2cd11f 100644
--- a/shield-stub/compat/api19-rust/Cargo.lock
+++ b/shield-stub/compat/api19-rust/Cargo.lock
@@ -242,7 +242,7 @@ checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
 [[package]]
 name = "mocikashield-api19"
-version = "1.8.2"
+version = "1.8.3"
 dependencies = [
  "cc",
  "chacha20poly1305",
diff --git a/shield-stub/compat/api19-rust/Cargo.toml b/shield-stub/compat/api19-rust/Cargo.toml
index 2a674b6..4e99383 100644
--- a/shield-stub/compat/api19-rust/Cargo.toml
+++ b/shield-stub/compat/api19-rust/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "mocikashield-api19"
-version = "1.8.2"
+version = "1.8.3"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 build = "../../src/main/rust/build.rs"
diff --git a/shield-stub/src/main/rust/Cargo.toml b/shield-stub/src/main/rust/Cargo.toml
index c4f1e64..905dd88 100644
--- a/shield-stub/src/main/rust/Cargo.toml
+++ b/shield-stub/src/main/rust/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "mocikashield"
-version = "1.8.2"
+version = "1.8.3"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 
diff --git a/tests/java/com/yqsh/protector/packer/Pvm2ProtectionCheck.java b/tests/java/com/yqsh/protector/packer/Pvm2ProtectionCheck.java
index 340d32f..e92f5a5 100644
--- a/tests/java/com/yqsh/protector/packer/Pvm2ProtectionCheck.java
+++ b/tests/java/com/yqsh/protector/packer/Pvm2ProtectionCheck.java
@@ -126,7 +126,7 @@ public static void main(String[] args) throws Exception {
             } else {
                 assert row.isNull("plaintext_policy"); skipped++;
                 if (row.getString("descriptor").startsWith("Lfixture/MainActivity;")) {
-                    assert row.getString("reason").equals("ui_runtime_glue"); excluded++;
+                    assert row.getString("reason").equals("ui_runtime_glue:virtual_contract"); excluded++;
                 } else assert row.getString("reason").equals("no_code");
             }
         }
@@ -235,7 +235,7 @@ private static void checkZeroMethodReports(Path root) throws Exception {
                 reasons.merge(row.getString("reason"), 1, Integer::sum);
             }
             assert reasons.get("no_code") == 1 && reasons.get("initializer") == 1 : reasons;
-            if (kind.equals("ui")) assert reasons.get("ui_runtime_glue") == 1 : reasons;
+            if (kind.equals("ui")) assert reasons.get("ui_runtime_glue:virtual_contract") == 1 : reasons;
             if (kind.equals("registers")) assert reasons.get("too many regs") == 1 : reasons;
             System.out.println("零方法失败报告通过：" + kind + " " + reasons);
         }
@@ -261,8 +261,11 @@ private static void writeClasses(Path path, List<ImmutableClassDef> classes) thr
     }
 
     private static void checkMethodCompatibility(Path root) throws Exception {
-        for (String reason : List.of("ui_runtime_glue", "data_resource_runtime_glue", "compiler_generated_bridge", "playback_compatibility"))
+        for (String reason : List.of("ui_runtime_glue", "data_resource_runtime_glue", "compiler_generated_bridge", "playback_compatibility")) {
             assert Pvm2Admission.classify(reason) == Pvm2Admission.SkipReason.compatibility;
+            for (String restriction : List.of("virtual_contract", "synchronization", "exception_region", "non_leaf_instruction"))
+                assert Pvm2Admission.classify(reason + ":" + restriction) == Pvm2Admission.SkipReason.compatibility;
+        }
         // 相同计算体不应因 UI、数据、资源、设备或媒体命名而整类消失。
         for (String type : List.of("Lfixture/ui/Rules;", "Lfixture/navigation/Rules;", "Lfixture/MainActivity;",
                 "Lfixture/adapter/Rules;", "Lfixture/QuoteView;", "Lfixture/RouteNavigator;",
@@ -282,27 +285,34 @@ private static void checkMethodCompatibility(Path root) throws Exception {
         var staticMethod = calculation(type, "utility", 9);
         for (String parent : List.of("Landroid/app/Activity;", "Lfixture/BaseActivity;", "Lexternal/Unknown;")) {
             var cls = calculationOwner(type, parent, List.of(), List.of());
-            assert AutoVmpPolicy.exclusionReason(cls, publicMethod).equals("ui_runtime_glue");
+            assert AutoVmpPolicy.exclusionReason(cls, publicMethod).equals("ui_runtime_glue:virtual_contract");
             assert AutoVmpPolicy.exclusionReason(cls, privateMethod) == null;
             assert AutoVmpPolicy.exclusionReason(cls, staticMethod) == null;
         }
         var callback = calculationOwner(type, "Ljava/lang/Object;", List.of("Lexternal/Callback;"), List.of());
-        assert AutoVmpPolicy.exclusionReason(callback, publicMethod).equals("ui_runtime_glue");
+        assert AutoVmpPolicy.exclusionReason(callback, publicMethod).equals("ui_runtime_glue:virtual_contract");
         var plain = calculationOwner(type, "Ljava/lang/Object;", List.of(), List.of());
         for (int flags : List.of(0x29, 0x20009, 0x49, 0x1009))
             assert AutoVmpPolicy.exclusionReason(plain, calculation(type, "calculate", flags)) != null;
+        for (int flags : List.of(0x29, 0x20009))
+            assert AutoVmpPolicy.exclusionReason(plain, calculation(type, "calculate", flags)).equals("ui_runtime_glue:synchronization");
+        var caught = new ImmutableMethod(type, "caught", List.of(), "I", 9, Set.of(), Set.of(),
+                new ImmutableMethodImplementation(1, List.of(new ImmutableInstruction11n(Opcode.CONST_4, 0, 1),
+                        new ImmutableInstruction11x(Opcode.RETURN, 0), new ImmutableInstruction11x(Opcode.MOVE_EXCEPTION, 0),
+                        new ImmutableInstruction11n(Opcode.CONST_4, 0, 0), new ImmutableInstruction11x(Opcode.RETURN, 0)),
+                        List.of(new ImmutableTryBlock(0, 1, List.of(new ImmutableExceptionHandler(null, 2)))), List.of()));
+        assert AutoVmpPolicy.exclusionReason(plain, caught).equals("ui_runtime_glue:exception_region");
         for (String generated : List.of("Lfixture/Rules$$ExternalSyntheticLambda0;", "Lfixture/Rules$1;"))
             assert AutoVmpPolicy.exclusionReason(calculationOwner(generated, "Ljava/lang/Object;", List.of(), List.of()),
                     calculation(generated, "calculate", 9)).equals("compiler_generated_bridge");
         // 混淆类仍直接继承已知框架类型时，生命周期和接口回调保持原执行方式。
         var obfuscated = calculation("Lfixture/a;", "callback", 1);
-        assert AutoVmpPolicy.exclusionReason(calculationOwner("Lfixture/a;", "Landroid/app/Activity;", List.of(), List.of()), obfuscated).equals("ui_runtime_glue");
-        assert AutoVmpPolicy.exclusionReason(calculationOwner("Lfixture/a;", "Ljava/lang/Object;", List.of("Landroid/view/View$OnClickListener;"), List.of()), obfuscated).equals("ui_runtime_glue");
-        // 原始 opcode、对象类型、字段/数组访问、调用和锁都不能借纯计算规则放行。
+        assert AutoVmpPolicy.exclusionReason(calculationOwner("Lfixture/a;", "Landroid/app/Activity;", List.of(), List.of()), obfuscated).equals("ui_runtime_glue:virtual_contract");
+        assert AutoVmpPolicy.exclusionReason(calculationOwner("Lfixture/a;", "Ljava/lang/Object;", List.of("Landroid/view/View$OnClickListener;"), List.of()), obfuscated).equals("ui_runtime_glue:virtual_contract");
+        // 字段/数组元素访问、调用和锁仍不能借叶子方法规则放行。
         var field = new ImmutableFieldReference(type, "state", "I");
         var call = new ImmutableMethodReference(type, "external", List.of(), "I");
-        for (var instruction : List.of(new ImmutableInstruction12x(Opcode.MOVE_OBJECT, 0, 1),
-                new ImmutableInstruction21c(Opcode.SGET, 0, field), new ImmutableInstruction22c(Opcode.IGET, 0, 1, field),
+        for (var instruction : List.of(new ImmutableInstruction21c(Opcode.SGET, 0, field), new ImmutableInstruction22c(Opcode.IGET, 0, 1, field),
                 new ImmutableInstruction23x(Opcode.AGET, 0, 1, 2),
                 new ImmutableInstruction35c(Opcode.INVOKE_STATIC, 0, 0, 0, 0, 0, 0, call),
                 new ImmutableInstruction35c(Opcode.INVOKE_VIRTUAL, 1, 1, 0, 0, 0, 0, call),
@@ -310,12 +320,7 @@ private static void checkMethodCompatibility(Path root) throws Exception {
                 new ImmutableInstruction21c(Opcode.NEW_INSTANCE, 0, new ImmutableTypeReference(type)))) {
             var method = new ImmutableMethod(type, "stateful", List.of(), "I", 9, Set.of(), Set.of(),
                     new ImmutableMethodImplementation(3, List.of(instruction, new ImmutableInstruction11x(Opcode.RETURN, 0)), List.of(), List.of()));
-            assert AutoVmpPolicy.exclusionReason(plain, method).equals("ui_runtime_glue") : instruction.getOpcode();
-        }
-        for (String reference : List.of("Ljava/lang/Object;", "[I")) {
-            var method = new ImmutableMethod(type, "objectArgument", List.of(new ImmutableMethodParameter(reference, Set.of(), null)),
-                    "I", 9, Set.of(), Set.of(), staticMethod.getImplementation());
-            assert AutoVmpPolicy.exclusionReason(plain, method).equals("ui_runtime_glue");
+            assert AutoVmpPolicy.exclusionReason(plain, method).equals("ui_runtime_glue:non_leaf_instruction") : instruction.getOpcode();
         }
 
         Path work = Files.createDirectory(root.resolve("method-compatibility"));
@@ -343,6 +348,38 @@ private static void checkMethodCompatibility(Path root) throws Exception {
             else { assert row.getString("reason").equals("initializer"); initializers++; }
         }
         assert verified == 18 && initializers == 3;
+        // 使用实际编译、跳板及产物校验验证引用叶子方法，不能只测试策略返回值。
+        classes.clear();
+        for (String owner : List.of("Lfixture/ui/ReferenceRules;", "Lfixture/data/ObjectRepository;", "Lfixture/player/TrackRules;")) {
+            List<ImmutableMethod> methods = new ArrayList<>();
+            for (String reference : List.of("Ljava/lang/Object;", "Ljava/lang/Integer;", "Ljava/lang/String;", "[I", "[[Ljava/lang/Object;")) {
+                var parameter = List.of(new ImmutableMethodParameter(reference, Set.of(), null));
+                for (int flags : List.of(1, 2, 9)) {
+                    boolean isStatic = (flags & 8) != 0;
+                    methods.add(new ImmutableMethod(owner, "identity" + flags, parameter, reference, flags, Set.of(), Set.of(),
+                            new ImmutableMethodImplementation(isStatic ? 1 : 3,
+                                    isStatic ? List.of(new ImmutableInstruction11x(Opcode.RETURN_OBJECT, 0))
+                                    : List.of(new ImmutableInstruction12x(Opcode.MOVE_OBJECT, 0, 2),
+                                            new ImmutableInstruction11x(Opcode.RETURN_OBJECT, 0)), List.of(), List.of())));
+                }
+                methods.add(new ImmutableMethod(owner, "unused", parameter, "I", 9, Set.of(), Set.of(),
+                        new ImmutableMethodImplementation(2, List.of(new ImmutableInstruction31i(Opcode.CONST, 0, 42),
+                                new ImmutableInstruction11x(Opcode.RETURN, 0)), List.of(), List.of())));
+            }
+            // D8 可将参数透传缩成单条 return；基本类型和宽值也不能被原地回填限制误排除。
+            for (String primitive : List.of("Z", "B", "S", "C", "I", "J", "F", "D")) {
+                boolean wide = primitive.equals("J") || primitive.equals("D");
+                methods.add(new ImmutableMethod(owner, "shortReturn", List.of(new ImmutableMethodParameter(primitive, Set.of(), null)),
+                        primitive, 9, Set.of(), Set.of(), new ImmutableMethodImplementation(wide ? 2 : 1,
+                                List.of(new ImmutableInstruction11x(wide ? Opcode.RETURN_WIDE : Opcode.RETURN, 0)), List.of(), List.of())));
+            }
+            classes.add(calculationOwner(owner, "Ljava/lang/Object;", List.of(), methods));
+        }
+        writeClasses(dex.resolve("classes.dex"), classes);
+        run(dex, config, code, report, "Lfixture/");
+        var references = new JSONObject(Files.readString(report)).getJSONArray("methods");
+        assert references.length() == 84;
+        for (Object value : references) assert ((JSONObject)value).getBoolean("artifact_verified") : value;
         // 精确必保清单也必须服从同一兼容判断；声明回调不会使其自动变得安全。
         String activity = "Lfixture/ui/ScreenActivity;";
         var sensitive = calculationOwner(activity, "Landroid/app/Activity;", List.of(),
@@ -362,7 +399,7 @@ private static void checkMethodCompatibility(Path root) throws Exception {
         for (Object value : mixed) {
             var row = (JSONObject) value;
             if (row.getBoolean("artifact_verified")) protectedCount++;
-            else { assert row.getString("reason").equals("ui_runtime_glue"); kept++; }
+            else { assert row.getString("reason").equals("ui_runtime_glue:virtual_contract"); kept++; }
         }
         assert kept == 1 && protectedCount == 1 : "转换成功率不能代替完整范围覆盖率";
         for (boolean safe : List.of(true, false)) {
@@ -375,10 +412,10 @@ private static void checkMethodCompatibility(Path root) throws Exception {
             } catch (InvocationTargetException failure) {
                 assert !safe && failure.getCause().getMessage().contains("关键方法未通过验证");
                 JSONObject row = new JSONObject(Files.readString(report)).getJSONArray("methods").getJSONObject(0);
-                assert !row.getBoolean("artifact_verified") && row.getString("reason").equals("ui_runtime_glue");
+                assert !row.getBoolean("artifact_verified") && row.getString("reason").equals("ui_runtime_glue:virtual_contract");
             }
         }
-        System.out.println("方法级兼容检查通过：通用命名、独立计算、回调保留、必保约束、3 类 21 方法中的 18 个计算方法转换");
+        System.out.println("方法级兼容检查通过：通用命名、独立计算、回调保留、必保约束、18 个计算方法、60 个引用叶子方法及 24 个基本类型短方法转换");
     }
 
     private static void fixture(Path path) throws Exception {
diff --git a/tests/java/com/yqsh/protector/packer/Pvm2RuntimeImages.java b/tests/java/com/yqsh/protector/packer/Pvm2RuntimeImages.java
index 5252daa..4e1aabe 100644
--- a/tests/java/com/yqsh/protector/packer/Pvm2RuntimeImages.java
+++ b/tests/java/com/yqsh/protector/packer/Pvm2RuntimeImages.java
@@ -80,14 +80,31 @@ public static void main(String[] args) throws Exception {
         List<Code> receivers = new ArrayList<>();
         for (var cls : dex.classDefs()) for (var method : dex.readClassData(cls).allMethods()) receivers.add(dex.readCode(method));
         if (receivers.size() != 4) throw new AssertionError("接收者样本数量不符");
-        for (int i = 0; i < 57; i++) {
+        for (int i = 0; i < 72; i++) {
             int isa = i % 3;
             Code input = i < 6 ? code : new Code(1, 0, 0, 0, new short[]{0x0012, 0x0027},
                     new Code.Try[0], new Code.CatchHandler[0]);
             if (i >= 9 && i < 45) input = branchInput((i - 9) / 6, ((i - 9) / 3) % 2 != 0);
-            if (i >= 45) input = receivers.get((i - 45) / 3);
-            Pvm2Compiler.Result result = Pvm2Compiler.tryCompile(i >= 45 ? dex : null, input, "I", true,
-                    Pvm2Morph.fromIsa(isa, new SecureRandom()), i >= 3, i >= 54 ? new String[]{"Ljava/lang/Object;", "I"} : i >= 51 ? new String[]{"J", "D", "F", "Z", "I"} : i >= 45 ? new String[]{"Ljava/lang/Object;"} : i >= 9 ? new String[]{"I", "I"} : new String[0]);
+            if (i >= 45 && i < 57) input = receivers.get((i - 45) / 3);
+            String returnType = "I";
+            String[] parameters = i >= 54 ? new String[]{"Ljava/lang/Object;", "I"} : i >= 51 ? new String[]{"J", "D", "F", "Z", "I"} : i >= 45 ? new String[]{"Ljava/lang/Object;"} : i >= 9 ? new String[]{"I", "I"} : new String[0];
+            if (i >= 57) {
+                // 引用透传、空值选择、同一对象比较、null 判断及数组透传，覆盖三种 ISA。
+                int kind = (i - 57) / 3;
+                short[] units = switch (kind) {
+                    case 0, 4 -> new short[]{0x1007, 0x0011};
+                    case 1 -> new short[]{0x0139, 3, 0x0211, 0x0111};
+                    case 2 -> branchInput(0, false).getInstructions();
+                    default -> new short[]{0x0138, 4, 0x0012, 0x0228, 0x1012, 0x000f};
+                };
+                boolean pair = kind == 1 || kind == 2;
+                input = new Code(pair ? 3 : 2, pair ? 2 : 1, 0, 0, units, new Code.Try[0], new Code.CatchHandler[0]);
+                returnType = kind == 2 || kind == 3 ? "I" : kind == 4 ? "[I" : "Ljava/lang/Object;";
+                parameters = pair ? new String[]{"Ljava/lang/Object;", "Ljava/lang/Object;"}
+                        : new String[]{kind == 4 ? "[I" : "Ljava/lang/Object;"};
+            }
+            Pvm2Compiler.Result result = Pvm2Compiler.tryCompile(i >= 45 ? dex : null, input, returnType, true,
+                    Pvm2Morph.fromIsa(isa, new SecureRandom()), i >= 3, parameters);
             if (!result.isOk()) throw new AssertionError(result.failReason);
             Files.write(Path.of(args[0], "image" + i + ".bin"), result.image);
             Files.write(Path.of(args[0], "image" + i + ".gcm"),
diff --git a/tests/native/pvm2_runtime_check.cpp b/tests/native/pvm2_runtime_check.cpp
index 664d5f4..0d1c35e 100644
--- a/tests/native/pvm2_runtime_check.cpp
+++ b/tests/native/pvm2_runtime_check.cpp
@@ -92,8 +92,8 @@ int main(int argc, char** argv) {
     assert(written == 123 && std::all_of(std::begin(boundary), std::end(boundary), [](uint8_t c) { return c == 0xa5; }));
     const auto plain = image();
     std::vector<uint8_t> code;
-    u16(code, 4); u16(code, 1); u32(code, 8); u32(code, 2); u16(code, argc > 1 && std::string(argv[1]) != "block-before-init" ? 155 : 98);
-    for (int i = 0; i < (argc > 1 && std::string(argv[1]) != "block-before-init" ? 155 : 98); i++) {
+    u16(code, 4); u16(code, 1); u32(code, 8); u32(code, 2); u16(code, argc > 1 && std::string(argv[1]) != "block-before-init" ? 170 : 98);
+    for (int i = 0; i < (argc > 1 && std::string(argv[1]) != "block-before-init" ? 170 : 98); i++) {
         auto bytes = plain;
         if (i >= 98) {
             std::ifstream input(std::string(argv[1]) + "/image" + std::to_string(i - 98) + ".bin", std::ios::binary);
@@ -306,6 +306,46 @@ int main(int argc, char** argv) {
         env->SetObjectArrayElement(mixedArgs, 0, nullptr);
         assert(!interpret(env, 2, id, mixedArgs) && env->ExceptionCheck()); env->ExceptionClear();
     }
+    // 不同 JNI 句柄指向同一对象时，引用相等与返回值必须保持 Java 身份语义。
+    jobjectArray unary = env->NewObjectArray(1, objectClass, nullptr);
+    jintArray array = env->NewIntArray(3);
+    jstring text = env->NewStringUTF("reference");
+    jstring equalText = env->NewStringUTF("reference");
+    jobject alias = env->NewLocalRef(text);
+    jobject references[] = {nullptr, wrappers[0], wrappers[1], wrappers[2], wrappers[3], wrappers[4], array, text, equalText, alias};
+    int referenceChecks = 0;
+    for (int isa = 0; isa < 3; isa++) {
+        for (jobject left : references) {
+            env->SetObjectArrayElement(unary, 0, left);
+            result = interpret(env, 2, 155 + isa, unary);
+            assert(!env->ExceptionCheck() && env->IsSameObject(result, left));
+            if (result) env->DeleteLocalRef(result);
+            result = interpret(env, 2, 164 + isa, unary);
+            assert(result && !env->ExceptionCheck() && env->CallIntMethod(result, unbox) == (left == nullptr));
+            env->DeleteLocalRef(result); referenceChecks += 2;
+            for (jobject right : references) {
+                env->SetObjectArrayElement(tailArgs, 0, left); env->SetObjectArrayElement(tailArgs, 1, right);
+                result = interpret(env, 2, 158 + isa, tailArgs);
+                assert(!env->ExceptionCheck() && env->IsSameObject(result, left ? left : right));
+                if (result) env->DeleteLocalRef(result);
+                result = interpret(env, 2, 161 + isa, tailArgs);
+                assert(result && !env->ExceptionCheck() && env->CallIntMethod(result, unbox) == env->IsSameObject(left, right));
+                env->DeleteLocalRef(result); referenceChecks += 2;
+            }
+        }
+        for (jobject value : {static_cast<jobject>(array), static_cast<jobject>(nullptr)}) {
+            env->SetObjectArrayElement(unary, 0, value);
+            result = interpret(env, 2, 167 + isa, unary);
+            assert(!env->ExceptionCheck() && env->IsSameObject(result, value));
+            if (result) env->DeleteLocalRef(result);
+            referenceChecks++;
+        }
+    }
+    assert(referenceChecks == 666);
+    for (int id = 155; id < 170; id++) assert(!items.at(id)->parsed_vm);
+    env->DeleteLocalRef(unary); env->DeleteLocalRef(array); env->DeleteLocalRef(text);
+    env->DeleteLocalRef(equalText); env->DeleteLocalRef(alias);
+    puts("引用叶子方法：三种 ISA 共 666 次透传、空值选择、身份比较、数组引用及清理验证通过");
     for (jobject wrapper : wrappers) if (wrapper) env->DeleteLocalRef(wrapper);
     env->DeleteLocalRef(sentinel); env->DeleteLocalRef(tailArgs); env->DeleteLocalRef(mixedArgs); env->DeleteLocalRef(objectClass);
     puts("声明参数类型：5 种包装引用、null、混合宽参数、数量/类型错误拒绝通过");
diff --git a/third_party/xopprotector/packer/src/main/java/com/yqsh/protector/packer/AutoVmpPolicy.java b/third_party/xopprotector/packer/src/main/java/com/yqsh/protector/packer/AutoVmpPolicy.java
index fe1490c..c48f2cc 100644
--- a/third_party/xopprotector/packer/src/main/java/com/yqsh/protector/packer/AutoVmpPolicy.java
+++ b/third_party/xopprotector/packer/src/main/java/com/yqsh/protector/packer/AutoVmpPolicy.java
@@ -133,39 +133,33 @@ static String exclusionReason(ClassDef owner, Method method) {
         if (reason == null && PlaybackCompatibility.keepOnArt(owner.getType(), method.getName()))
             reason = "playback_compatibility";
         if (reason == null) return null;
-        return isIndependentCalculation(owner, method) ? null : reason;
+        if (method.getImplementation() == null || method.getName().startsWith("<")) return reason;
+        String restriction = independentMethodRestriction(owner, method);
+        return restriction == null ? null : reason + ":" + restriction;
     }
 
-    private static boolean isIndependentCalculation(ClassDef owner, Method method) {
+    private static String independentMethodRestriction(ClassDef owner, Method method) {
         int flags = method.getAccessFlags();
         var code = method.getImplementation();
-        if (code == null || method.getName().startsWith("<") || !code.getTryBlocks().isEmpty()
-                || (flags & (0x20 | 0x20000)) != 0) return false;
+        if ((flags & (0x20 | 0x20000)) != 0) return "synchronization";
+        if (!code.getTryBlocks().isEmpty()) return "exception_region";
         // 私有/静态方法不覆盖框架回调；其它实例方法仅放行无继承/接口契约的普通类。
         // ponytail: 未解析外部及跨 DEX 父类的回调契约，保守保留其虚方法；扩展需完整继承图验证。
         if ((flags & (0x2 | 0x8)) == 0 && (!"Ljava/lang/Object;".equals(owner.getSuperclass())
                 || !owner.getInterfaces().isEmpty() || method.getName().equals("hashCode")
-                || method.getName().equals("finalize"))) return false;
-        if (!primitive(method.getReturnType(), true)) return false;
-        for (CharSequence parameter : method.getParameterTypes())
-            if (!primitive(parameter.toString(), false)) return false;
-        // ponytail: 命名兼容排除仅放行无对象/字段/数组/外部调用的数值叶子方法；其余语义仍由 ART 执行。
-        // 后续扩展须先证明对象状态与框架调用语义，不能直接移除包路径或类名规则。
+                || method.getName().equals("finalize"))) return "virtual_contract";
+        // ponytail: 仅放行无状态访问、外部调用的叶子方法；引用参数、透传与比较复用已有类型化运行时。
+        // 字段、数组元素、调用等仍留在 ART；扩展需验证对象状态与框架语义，不能直接移除命名规则。
         for (var instruction : code.getInstructions()) {
             Opcode opcode = instruction.getOpcode();
             if (opcode == Opcode.PACKED_SWITCH_PAYLOAD || opcode == Opcode.SPARSE_SWITCH_PAYLOAD) continue;
             Short value = OPCODES.getOpcodeValue(opcode);
-            if (value == null) return false;
+            if (value == null) return "non_leaf_instruction";
             int op = Short.toUnsignedInt(value);
-            if (!(op <= 0x06 || (op >= 0x0e && op <= 0x10) || (op >= 0x12 && op <= 0x19)
-                    || (op >= 0x28 && op <= 0x3d) || (op >= 0x7b && op <= 0xe2))) return false;
+            if (!(op <= 0x09 || (op >= 0x0e && op <= 0x11) || (op >= 0x12 && op <= 0x19)
+                    || (op >= 0x28 && op <= 0x3d) || (op >= 0x7b && op <= 0xe2))) return "non_leaf_instruction";
         }
-        return true;
-    }
-
-    private static boolean primitive(String type, boolean allowVoid) {
-        return type != null && type.length() == 1
-                && ((allowVoid && type.equals("V")) || "ZBSCIJFD".indexOf(type.charAt(0)) >= 0);
+        return null;
     }
 
     /** 兼容性排除只影响执行准入，不能从用户选择范围的覆盖率分母中消失。 */
diff --git a/third_party/xopprotector/packer/src/main/java/com/yqsh/protector/packer/PackerMain.java b/third_party/xopprotector/packer/src/main/java/com/yqsh/protector/packer/PackerMain.java
index 7567fc6..a8ccc77 100644
--- a/third_party/xopprotector/packer/src/main/java/com/yqsh/protector/packer/PackerMain.java
+++ b/third_party/xopprotector/packer/src/main/java/com/yqsh/protector/packer/PackerMain.java
@@ -2112,7 +2112,7 @@ private InsnRecord extractOne(com.android.dex.Dex dex, RandomAccessFile raf,
             String reason = pvm2Exclusions.get(key);
             // 保持原转换成功率口径：类兼容预筛不算编译尝试；媒体准入失败仍计入。
             // 完整选择范围的覆盖率由逐方法报告统计，不能在这里删除跳过项。
-            if (reason.equals("playback_compatibility")) {
+            if (reason.equals("playback_compatibility") || reason.startsWith("playback_compatibility:")) {
                 pvm2Admission.noteCandidate();
                 pvm2Admission.noteFail(reason);
             }
@@ -2140,11 +2140,9 @@ private InsnRecord extractOne(com.android.dex.Dex dex, RandomAccessFile raf,
 
         byte[] returnBytes = getReturnByteCodes(returnType);
         int byteSize = units.length * 2;
-        if (byteSize < returnBytes.length) {
+        // PVM2 由 DexPool 整体替换方法体，不受旧式原地回填的最小长度限制。
+        if (phase == ExtractPhase.HOLLOW_OR_VMP && byteSize < returnBytes.length) {
             if (methodReport != null) methodReport.skipped(key, "code_too_short");
-            if (phase == ExtractPhase.TRUE_VMP_ONLY) {
-                pvm2Admission.noteCandidate();
-            }
             return null;
         }
 
@@ -2170,8 +2168,7 @@ private InsnRecord extractOne(com.android.dex.Dex dex, RandomAccessFile raf,
                         + ": " + compiled.failReason);
                 return null;
             }
-            // Stub until DexPool trampoline rewrite replaces the code item.
-            writeReturnStub(raf, insnsOffset, returnBytes, byteSize);
+            // 保持输入 DEX 有效，随后整体写入并核验跳板；不能向短方法越界写占位代码。
             toEncrypt = compiled.image;
             if (methodReport != null) methodReport.compiled(key, compiled.image);
             plainSize = compiled.image.length;
diff --git a/third_party/xopprotector/packer/src/main/java/com/yqsh/protector/packer/Pvm2Admission.java b/third_party/xopprotector/packer/src/main/java/com/yqsh/protector/packer/Pvm2Admission.java
index 84e562e..b62cb78 100644
--- a/third_party/xopprotector/packer/src/main/java/com/yqsh/protector/packer/Pvm2Admission.java
+++ b/third_party/xopprotector/packer/src/main/java/com/yqsh/protector/packer/Pvm2Admission.java
@@ -102,6 +102,10 @@ public static SkipReason classify(String failReason) {
             return SkipReason.other;
         }
         String r = failReason.toLowerCase(Locale.US);
+        // 方法限制细分不改变兼容预筛与编译尝试的统计口径。
+        if (r.startsWith("ui_runtime_glue:") || r.startsWith("data_resource_runtime_glue:")
+                || r.startsWith("playback_compatibility:") || r.startsWith("compiler_generated_bridge:"))
+            return SkipReason.compatibility;
         if (r.contains("unsupported opcode 0x")) {
             return SkipReason.unsupported_opcode;
         }
diff --git a/tools/xop-pvm2-packer.jar b/tools/xop-pvm2-packer.jar
index 08c1bfb..0c77754 100644
Binary files a/tools/xop-pvm2-packer.jar and b/tools/xop-pvm2-packer.jar differ