diff --git a/docs/虎牙hyCred签发-侦察笔记.md b/docs/虎牙hyCred签发-侦察笔记.md
index 8bd9b0b..3b31d37 100644
--- a/docs/虎牙hyCred签发-侦察笔记.md
+++ b/docs/虎牙hyCred签发-侦察笔记.md
@@ -160,3 +160,11 @@ saveLoginData bean(1536B dump)=C++对象, cred在堆上经指针引用, 非内
   -> onLeave 读 out(x2) std::string 即152字符hyCred原文。
 scripts/hook_beandump.py 已建(时序模板可复用), 下轮改钩子地址重跑一次登录即得。
 另: 响应JSON键已确认含"cred"键(0x1c36e8)。
+
+## ★ 终局验证(全链路)
+
+活体采集(桥调getCred,零重登) -> hyCred(CiAXHUiF.../114B)
+-> cert_forge 铸新证书 -> bindQrLoginUser stage=2
+-> tryQrLogin uid=1199666914671 + biztoken344B ✅
+多账号流程定型: 每号设备登录一次+桥采cred入库, 此后永久全自动。
+纯Python长连接签发客户端(0x1001+JSON)留作后续可选优化, 参数已全部备齐。
diff --git a/evidence/forge_bind_result.json b/evidence/forge_bind_result.json
index e2bd7a3..a42541f 100644
--- a/evidence/forge_bind_result.json
+++ b/evidence/forge_bind_result.json
@@ -4,9 +4,9 @@
    "ok": true,
    "uid": 1199666914671,
    "biztoken_len": 344,
-   "biztoken": "AQAFwnM8LGUdBevEHD9p23OYot9Oo5t-Fn5w7_Wll1ct-BL1-E5tEiGUqf6uIEljOfasK301bY-QJYSsC-YXK6yGPcGXaOiudmU_TqlW0r1bFMQEAt4Abkwa9Svcz_KgecGv0tIYmwB-b7xWRhSDSO7AiIBWe9iFN1cIz-jQOl9vF7Mj84AUwYmF16CvKqnHJx-cgceOUXC8GSvioLnumB7EtnPVbsjCfqkTcrG8jvccF_RN7dsVxgTQ_1cTniSHr__yTil2n7L5x2bCUKh4mN7oXxyNjEkpHT4264quUhofp6nNfV_iJeY5bU30-yTXSVNSJby6xpmfO_eDRSfie-PL"
+   "biztoken": "AQA0HB1eLBj6FYHHIIlA18jOJL4M2hm0cVgwCnpQQT6TFZ7kHUyrDPojHYobR5NxwphHBqoCZkSmrzwf1ejbc3dzgZVw6auP1LBFeuzyFyyqJSSamtM0QM09u7vnRdKMZ08_i5fMfyrN6jJGp6qsnQsJf_bJ3kXGGnTcvzqoJoeIQ8hvHTsqoykjXsAJOU2bHTIOTTIKpyRoSbbTVLYg9l19QtQRhKTZfmlJbyahFT_IZi4SGrGRQJn12s53fj8Iep-78FCrNYi0DpjI7UhOxClSl880X7OlZRvhjL_k7eU1oRCWihyGsDCX6WBqvW-NWroc20WYEnMkLyfFf03WToWh"
   }
  },
- "p1_new_hex": "010400353030381400c25220f81f60cf64ee54e83ef1eab6bdd047b5af28003032646633393837393734333265616465666363313237363731313961643565383039393933383972000a80a762e4c0ff033fb559c52b94b77d6995ead51d10ebeddf48db7350d1adc2b2b58725edc3353e38940458ac0cf1229abf18488aa5a474ab2770d8739bcb342bcf55dd6eee67e847cad7e4d553a0409d597908193a9c2ee65926a46df4fe741ea72e92e611c665602789c338530990fcda",
- "ts": 1787643388.3479419
+ "p1_new_hex": "010400353030381400c25220f81f60cf64ee54e83ef1eab6bdd047b5af28003032646633393837393734333265616465666363313237363731313961643565383039393933383972000a20171d4885bb9bb40f29517ab490f3634a0640e942e24039e2f471a5a66a0c64662b68c43f64a90ab982d8298bfc5de4e58a0bb6617a7ab8ecc730cde4a28bd828261096ca95b6247bba5e4714395166f9a22eb0c9954e6d0890ba40fa951e70e63c7c4c8e8e5547f6ca029830f31adbe8",
+ "ts": 1787649782.6306071
 }
\ No newline at end of file
diff --git a/scripts/probe_forge_cert_bind.py b/scripts/probe_forge_cert_bind.py
index 46e2fe2..ef45c4f 100644
--- a/scripts/probe_forge_cert_bind.py
+++ b/scripts/probe_forge_cert_bind.py
@@ -99,7 +99,7 @@ def main() -> int:
     #       => 不校验时效。故铸造策略 = 保留原 nonce/指纹, 替换 cred 字段。
     # 实验 C: 换上 frida_cred_dump 里更早签发的 hyCred(同账号不同轮换值)。
     #        若 bind 成功 => 铸造机制完全打通(任意有效cred即可铸其证书)。
-    old_cred = json.load(open("/tmp/old_cred.json"))
+    old_cred = json.load(open("evidence/hycred_live.json"))
     cred_old = bytes.fromhex(old_cred["bin_hex"])
     P1_new = build_p1(b"5008", fields["fingerprint"], cred_old,
                       rnd=fields["rnd"])  # 原始 nonce