diff --git a/.gitignore b/.gitignore
index 35fa748..8d895de 100644
--- a/.gitignore
+++ b/.gitignore
@@ -60,3 +60,4 @@ wechat_plain/scripts/lsposed-wechat-sendmsg/local.properties
 wechat_plain/scripts/lsposed-wechat-sendmsg/*.keystore
 wechat_plain/scripts/platform-tools/
 wechat_plain/scripts/archive/
+*.idsig
diff --git a/xhs_lsposed_a16_fix/STATUS.md b/xhs_lsposed_a16_fix/STATUS.md
index fd63b9a..d031c56 100644
--- a/xhs_lsposed_a16_fix/STATUS.md
+++ b/xhs_lsposed_a16_fix/STATUS.md
@@ -282,8 +282,11 @@ uvicorn event_server:app --host 127.0.0.1 --port 8765
 ├── ipc_bridge.h            ← 已打补丁的头文件
 ├── ipc_bridge.cpp          ← 已打补丁的源文件
 ├── xhshook_src/
-│   └── Hook.java           ← xhshook v2 源码
-└── xhshook_v2_signed.apk   ← 预构建的 APK（当前已安装版本，classes.dex=3400 字节）
+│   └── Hook.java           ← xhshook v3 源码（含 HTTP 转发到 :8765/xhs_params）
+└── xhshook_v2_signed.apk   ← 预构建的 APK（当前已安装版本，classes.dex=6328 字节，含 HTTP 转发）
+
+~/.hermes/event_bus/
+└── event_server.py         ← FastAPI event bus，含 POST/GET /xhs_params 端点
 ```
 
 ---
diff --git a/xhs_lsposed_a16_fix/update_xhshook_db.sh b/xhs_lsposed_a16_fix/update_xhshook_db.sh
index 8616c83..71e20af 100755
--- a/xhs_lsposed_a16_fix/update_xhshook_db.sh
+++ b/xhs_lsposed_a16_fix/update_xhshook_db.sh
@@ -43,5 +43,19 @@ echo "Verified path in DB: $ACTUAL"
 $ADB push /tmp/mc_upd.db /data/local/tmp/mc_upd_clean.db
 $ADB shell 'su -c "cp /data/local/tmp/mc_upd_clean.db /data/adb/lspd/config/modules_config.db && rm -f /data/adb/lspd/config/modules_config.db-wal /data/adb/lspd/config/modules_config.db-shm && echo phase2 done"'
 
-echo "DB updated. Now: am force-stop com.xingin.xhs → open XHS manually."
-echo "(If lspd cache doesn't auto-refresh, reboot is needed for changes to take effect.)"
+# --- Phase 3: verify + fix scope table (mid can change after reinstall) ---
+# Get current mid for xhshook from the freshly-checkpointed DB
+MID=$(sqlite3 /tmp/mc_upd.db "SELECT mid FROM modules WHERE module_pkg_name='com.hermes.xhshook';")
+echo "Current mid: $MID"
+SCOPE=$(sqlite3 /tmp/mc_upd.db "SELECT count(*) FROM scope WHERE mid=$MID AND app_pkg_name='com.xingin.xhs';")
+if [ "$SCOPE" -eq 0 ]; then
+    echo "scope table missing entry for mid=$MID — inserting..."
+    sqlite3 /tmp/mc_upd.db "INSERT OR REPLACE INTO scope (mid, app_pkg_name, user_id) VALUES ($MID, 'com.xingin.xhs', 0);"
+    $ADB push /tmp/mc_upd.db /data/local/tmp/mc_upd_scope.db
+    $ADB shell "su -c 'cp /data/local/tmp/mc_upd_scope.db /data/adb/lspd/config/modules_config.db && rm -f /data/adb/lspd/config/modules_config.db-wal /data/adb/lspd/config/modules_config.db-shm && echo phase3 scope fixed'"
+else
+    echo "scope table OK (mid=$MID, com.xingin.xhs row exists)"
+fi
+
+echo "DB updated. Reboot required for lspd to reload config."
+echo "After reboot: unlock PIN → open XHS manually."