diff --git a/patch_v2/hello_app/hello b/patch_v2/hello_app/hello
index 4b98a74..3c6fc5f 100755
Binary files a/patch_v2/hello_app/hello and b/patch_v2/hello_app/hello differ
diff --git a/patch_v2/hello_app/hello.c b/patch_v2/hello_app/hello.c
index 388a014..4d4e87c 100644
--- a/patch_v2/hello_app/hello.c
+++ b/patch_v2/hello_app/hello.c
@@ -369,16 +369,46 @@ static void demo_rebuild_to(int scroll)
     demo_paint();
 }
 
-/* 局部刷新一个控件：清底 + 重画 + flush 其几何矩形（App 自记 rect） */
-static void d_redraw(meow_widget *w, rect_t r)
+/* 两矩形是否相交（P1：局部重绘时判定哪些控件落在该区） */
+static int d_rect_overlap(rect_t a, rect_t b)
 {
-    if (!w) return;
+    return a.x < b.x + b.w && a.x + a.w > b.x && a.y < b.y + b.h && a.y + a.h > b.y;
+}
+
+/* 局部刷新一个区域：清底 + 按 demo_paint 同序重画「落在该区的所有控件/文本/chrome」，再 flush。
+ * 根治 P1：旧 d_redraw 只清底 + 重画单个控件，会把重叠区里上层控件（chrome 如 FAB/导航栏）
+ * 一并清掉、只刷单个控件矩形 → 下层动态控件（如圆形进度条实时重绘）盖住/抹掉上层浮层。
+ * 修法：局部刷新=重画该区内完整 z 栈（内容→标题→slider 值→chrome，与整帧 paint 一致），
+ * 下层动态重绘不再抹掉上层。仍是局部（只画相交控件，不整帧、不冲状态栏）。 */
+static void d_paint_region(rect_t r)
+{
+    if (r.w <= 0 || r.h <= 0) return;
     const meow_theme *th = meow_theme_get();
     meow_ui_fill_rect(r.x, r.y, r.w, r.h, th->bg);
-    meow_widget_draw(w);
+    for (int i = 0; i < g_dslot_n; i++)
+        if (d_rect_overlap(g_dslot[i].r, r)) meow_widget_draw(g_dslot[i].w);
+    for (int i = 0; i < g_dtitle_n; i++)
+        if (g_dtitle[i].y < r.y + r.h && g_dtitle[i].y + meow_ui_text_height(20) > r.y &&
+            g_dtitle[i].x < r.x + r.w && g_dtitle[i].x + meow_ui_text_width(g_dtitle[i].s, 20) > r.x)
+            meow_ui_text(g_dtitle[i].x, g_dtitle[i].y, g_dtitle[i].s, 20, th->primary);
+    if (g_dslider && d_rect_overlap(r_slider_txt, r)) {
+        char buf[28]; snprintf(buf, sizeof buf, "slider = %d", meow_slider_get(g_dslider));
+        meow_ui_text(r_slider_txt.x, r_slider_txt.y, buf, 20, th->dim);
+    }
+    /* chrome（固定；后画保证覆盖内容区溢出） */
+    if (d_rect_overlap(r_tb, r))  meow_widget_draw(g_tb);
+    if (d_rect_overlap(r_nav, r)) meow_widget_draw(g_nav);
+    if (d_rect_overlap(r_fab, r)) meow_widget_draw(g_fab);
     meow_ui_flush_region(r.x, r.y, r.w, r.h);
 }
 
+/* 局部刷新一个控件：整区清底 + 重画重叠 z 栈（w 仅用于取矩形；重画逻辑见 d_paint_region） */
+static void d_redraw(meow_widget *w, rect_t r)
+{
+    (void)w;
+    d_paint_region(r);
+}
+
 static void d_toggle_sel(meow_widget *w, rect_t r)
 {
     if (!w) return;
@@ -433,8 +463,7 @@ static void demo_on_tap(int x, int y)
         char lb[16]; snprintf(lb, sizeof lb, "+%d", g_demo_fab);
         meow_widget_free(g_fab);
         g_fab = meow_fab_create(r_fab.x, r_fab.y, 56, lb);
-        meow_widget_draw(g_fab);
-        meow_ui_flush_region(r_fab.x, r_fab.y, r_fab.w, r_fab.h);
+        d_paint_region(r_fab);   /* 重画 FAB 及其下重叠内容（z 序一致，防抹掉下层） */
         return;
     }
     if (g_nav) {
@@ -463,24 +492,24 @@ static void demo_slider_drag(int x)
     g_ds.slider = frac * 100 / r_slider.w;
     meow_slider_set(g_dslider, g_ds.slider);
     d_redraw(g_dslider, r_slider);
-    const meow_theme *th = meow_theme_get();
-    char buf[28]; snprintf(buf, sizeof buf, "slider = %d", g_ds.slider);
-    meow_ui_fill_rect(r_slider_txt.x, r_slider_txt.y, r_slider_txt.w, r_slider_txt.h, th->bg);
-    meow_ui_text(r_slider_txt.x, r_slider_txt.y, buf, 20, th->dim);
-    meow_ui_flush_region(r_slider_txt.x, r_slider_txt.y, r_slider_txt.w, r_slider_txt.h);
+    d_paint_region(r_slider_txt);   /* 重画 slider 值文本（z 序一致） */
 }
 
-/* demo 页 on_touch_down：锁一种拖拽（slider > list > 页内容）。非 demo 态跳过。 */
+/* demo 页 on_touch_down：锁一种拖拽（slider > list > 页内容）。非 demo 态跳过。
+ * P2：滚动焦点按「本次触摸起作用的控件」绑定、抬手/命中其它区域即释放——命中非 list
+ * 区域时不再沿用「已聚焦列表」的旧焦点去滚列表，而是切到页/上一层滚动（否则滑完列表再
+ * 滑页面，焦点仍在列表里继续滚列表，需额外点一下才出来）。 */
 static void demo_touch_down(int x, int y)
 {
     g_drag_slider = 0; g_drag_list = 0; g_drag_page = 0; g_drag_page_delta = 0;
     if (!g_demo) return;
     if (meow_widget_hit(g_dslider, x, y)) { g_drag_slider = 1; demo_slider_drag(x); return; }
-    /* 命中列表，或「已聚焦列表」时（g_demo_focus=1）→ 拖动滚列表（与原 on_swipe 的焦点语义一致） */
-    if (g_dlc && (meow_widget_hit(g_dlc, x, y) || g_demo_focus)) {
+    /* 命中列表 → 本次手势滚列表（焦点绑到列表） */
+    if (g_dlc && meow_widget_hit(g_dlc, x, y)) {
         g_demo_focus = 1; g_drag_list = 1; g_drag_list_last_y = y; return;
     }
-    /* 页内容视口内非 slider/list：页面拖拽跟手（按钮亦视为可滚动起点，阈值由 SDK tap/swipe 分流） */
+    /* 未命中列表 → 释放列表焦点，本次手势滚页面 */
+    g_demo_focus = 0;
     if (y >= g_demo_ct && y < g_demo_cb && x >= 0 && x < meow_ui_width()) {
         g_drag_page = 1; g_drag_page_last_y = y;
     }
diff --git a/patch_v2/sdk/meow_ui_widget.c b/patch_v2/sdk/meow_ui_widget.c
index ef9c5d7..c6a473f 100644
--- a/patch_v2/sdk/meow_ui_widget.c
+++ b/patch_v2/sdk/meow_ui_widget.c
@@ -984,26 +984,40 @@ void meow_widget_draw(meow_widget *w)
         int last  = (item > 0) ? (off + vp) / item + 1 : 0;
         if (first < 0) first = 0;
         if (last > w->count) last = w->count;
+        /* 视口绝对边界：列表只在其内绘制，杜绝越界泄漏（部分行滚出视口时把填充/分隔线/文本
+         * 画到视口外 → 标脏并上屏 → 标题栏/底部残留脏区，P3）。 */
+        int vx0 = w->x, vy0 = w->y, vx1 = w->x + w->w, vy1 = w->y + w->h;
+        int thh = meow_ui_text_height(th->font_body);
         for (int i = first; i < last; i++) {
             char label[64] = "";
             if (!w->src || !w->src(i, label, (int)sizeof label, w->ctx)) continue;
             int pos = i * item - off;   /* 相对容器起点的可视位置 */
             if (w->horizontal) {
                 int rx = w->x + pos;
-                if (rx >= w->x + w->w) break;
-                if (i == w->sel) meow_ui_fill_rect(rx, w->y, item, w->h, th->primary);
+                if (rx >= vx1) break;                       /* 完全在右缘外 */
+                if (rx + item <= vx0) continue;             /* 完全在左缘外（滚出残余） */
+                int cl = rx > vx0 ? rx : vx0;               /* 可见左界 */
+                int cr = (rx + item) < vx1 ? (rx + item) : vx1;   /* 可见右界 */
+                if (i == w->sel) meow_ui_fill_rect(cl, w->y, cr - cl, w->h, th->primary);
                 uint32_t col = (i == w->sel) ? 0xFFFFFF : th->onSurface;
-                meow_ui_text_center(rx + item / 2, w->y + (w->h - meow_ui_text_height(th->font_body)) / 2,
-                                    label, th->font_body, col);
-                meow_ui_fill_rect(rx + item - 1, w->y, 1, w->h, th->onSurfaceVariant);
+                int ty = w->y + (w->h - thh) / 2;
+                if (rx >= vx0 && rx + item <= vx1)          /* 仅整项可见才画文本（防泄漏） */
+                    meow_ui_text_center(rx + item / 2, ty, label, th->font_body, col);
+                int sxp = rx + item - 1;                    /* 分隔线：仅当落在可见区 */
+                if (sxp >= cl && sxp < cr) meow_ui_fill_rect(sxp, w->y, 1, w->h, th->onSurfaceVariant);
             } else {
                 int ry = w->y + pos;
-                if (ry >= w->y + w->h) break;
-                if (i == w->sel) meow_ui_fill_rect(w->x, ry, w->w, item, th->primary);
+                if (ry >= vy1) break;                       /* 完全在底缘外 */
+                if (ry + item <= vy0) continue;             /* 完全在顶缘外（滚出残余） */
+                int cl = ry > vy0 ? ry : vy0;               /* 可见顶界 */
+                int cr = (ry + item) < vy1 ? (ry + item) : vy1;   /* 可见底界 */
+                if (i == w->sel) meow_ui_fill_rect(w->x, cl, w->w, cr - cl, th->primary);
                 uint32_t col = (i == w->sel) ? 0xFFFFFF : th->onSurface;
-                meow_ui_text(w->x + pad, ry + (item - meow_ui_text_height(th->font_body)) / 2,
-                             label, th->font_body, col);
-                meow_ui_fill_rect(w->x, ry + item - 1, w->w, 1, th->onSurfaceVariant);
+                int ty = ry + (item - thh) / 2;
+                if (ty >= vy0 && ty + thh <= vy1)           /* 文本不越界才画（防标题/底部泄漏） */
+                    meow_ui_text(w->x + pad, ty, label, th->font_body, col);
+                int sy = ry + item - 1;                     /* 分隔线：仅当落在可见区 */
+                if (sy >= cl && sy < cr) meow_ui_fill_rect(w->x, sy, w->w, 1, th->onSurfaceVariant);
             }
         }
         if (disabled) meow_ui_fill_rect_alpha(w->x, w->y, w->w, w->h, th->onSurface, 90);
diff --git a/patch_v2/sdk/test_p1p2p3_repro.c b/patch_v2/sdk/test_p1p2p3_repro.c
new file mode 100644
index 0000000..eaefad4
--- /dev/null
+++ b/patch_v2/sdk/test_p1p2p3_repro.c
@@ -0,0 +1,148 @@
+/* test_p1p2p3_repro.c — 宿主复现并校验 P1/P2/P3 三个真机问题的修复（离屏 480x720，16bpp）。
+ *
+ * 方法：#include 真实 `hello.c`（改 hello 的 main 名），直接驱动 demo 的真实函数
+ * （demo_paint / d_redraw / demo_touch_down / demo_rebuild_to），对 back_buf 做像素断言。
+ * 这样测的是「真实 demo 代码 + 真实 SDK」，不是模拟桩。不依赖 /dev/fb0 / 字库 / launcher。
+ *
+ * 覆盖：
+ *   P1  z-order 叠层：圆形进度条(实时重绘)与 FAB 浮层重叠时，局部重绘不再清掉/盖住 FAB。
+ *       旧 d_redraw=清底+只画单控件 → FAB 重叠区被抹成背景；新 d_redraw=d_paint_region
+ *       重画重叠区完整 z 栈（内容→标题→slider值→chrome）→ FAB 保持。
+ *   P2  list 焦点：命中非 list 区域时释放列表焦点、切页滚动（不再沿用旧焦点继续滚列表）。
+ *   P3  list 脏区：W_LIST 绘制已裁剪到视口；滚动(非整行偏移)+选中行不再向标题间隙/底缘下泄漏
+ *       填充（此前泄漏会标脏并上屏 → 标题栏/底部残留）。
+ *
+ * 编译（宿主 gcc，链真实 gfx/sys/theme/vol/log/widget/input/activity/dialog/ime/img/config/
+ * notify/ipc + 打桩 font/global(test_host_stub) + stb_image）：
+ *   gcc -Wall -Wextra -DMEOW_UI_HOST_TEST -Dmain=hello_app_main \
+ *       -o test_p1p2p3_repro test_p1p2p3_repro.c test_host_stub.c \
+ *       meow_ui_gfx.c meow_ui_sys.c meow_ui_theme.c meow_ui_vol.c meow_ui_log.c \
+ *       meow_ui_widget.c meow_ui_input.c meow_ui_activity.c meow_ui_dialog.c meow_ui_ime.c \
+ *       meow_ui_img.c meow_ui_config.c meow_ui_notify.c meow_notify_ipc.c stb_image.c \
+ *       -I. -I../hello_app -I../meow_launcherd -pthread -lm
+ * 运行：MEOW_UI_DUMP=/tmp/repro.ppm ./test_p1p2p3_repro   （optional，dump 最终屏幕）
+ *
+ * 修复前（无 P1/P2/P3 修法）预期输出：RESULT: 4 FAIL(S)；
+ * 修复后：RESULT: ALL PASS。
+ */
+#include "meow_ui.h"
+#include "meow_ui_internal.h"
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+#define main hello_app_main      /* 让 hello.c 的 main 改名，由本文件提供 main */
+#include "hello.c"
+#undef main
+
+/* ---- 像素读取 ---- */
+static void rd_px(int x, int y, int *r, int *g, int *b)
+{
+    unsigned char *bb = meow_ui_back_buf();
+    int line = meow_ui_back_buf_pitch(), bpp = meow_ui_back_buf_bpp();
+    if (!bb) { *r=*g=*b=0; return; }
+    if (bpp == 16) {
+        uint16_t px = *(uint16_t *)(bb + (size_t)y * line + (size_t)x * 2);
+        *r = (((px >> 11) & 0x1F) << 3) | ((px >> 11) & 0x1F) >> 2;
+        *g = (((px >> 5) & 0x3F) << 2) | ((px >> 5) & 0x3F) >> 4;
+        *b = ((px & 0x1F) << 3) | ((px & 0x1F) >> 2);
+    } else {
+        uint32_t px = *(uint32_t *)(bb + (size_t)y * line + (size_t)x * 4);
+        *r = (px >> 16) & 0xFF; *g = (px >> 8) & 0xFF; *b = px & 0xFF;
+    }
+}
+static int near(int a, int b) { int d = a - b; if (d < 0) d = -d; return d <= 12; }
+static int is_bg(int r, int g, int b)
+{
+    const meow_theme *th = meow_theme_get();
+    int br = (th->bg >> 16) & 0xFF, bg = (th->bg >> 8) & 0xFF, bb = th->bg & 0xFF;
+    return near(r, br) && near(g, bg) && near(b, bb);
+}
+static void pr_px(const char *tag, int x, int y)
+{
+    int r, g, b; rd_px(x, y, &r, &g, &b);
+    printf("   %-26s px(%d,%d)=%02X%02X%02X %s\n", tag, x, y, r, g, b, is_bg(r, g, b) ? "[bg]" : "[ink]");
+}
+
+int main(void)
+{
+    setenv("MEOW_UI_DUMP", "/tmp/repro.ppm", 1);
+    meow_ui_opts o = { 480, 720 };
+    if (meow_ui_init(&o) != 0) { printf("init failed\n"); return 1; }
+    meow_ui_activity_push(ACT_DEMO);    /* demo 控件 owner=ACT_DEMO，命中/绘制对齐 */
+    demo_init();                        /* 建造 chrome + 内容(scroll=0)，owner=ACT_DEMO */
+
+    int fails = 0;
+
+    /* ================= P1：局部重绘不盖浮层（FAB） =================
+     * 场景：scroll=0 时圆形进度(413..453,605..645) 与 FAB(406..462,616..672) 重叠。
+     * demo_paint 先画内容后画 chrome → 场景正确 FAB 在上。随后「局部重绘进度条」：
+     *   旧（清底+只画进度条+flush 其矩形）→ FAB 重叠区被清掉；
+     *   新（清底+重画重叠区内所有控件=hello d_redraw/d_paint_region）→ FAB 保持。 */
+    demo_paint();
+    int fx = r_fab.x + 28, fy = r_fab.y + 6;   /* FAB 内、远离 "+" 文本处 */
+    int s0r, s0g, s0b; rd_px(fx, fy, &s0r, &s0g, &s0b);
+    printf("P1 scene (demo_paint) FAB-overlap "); pr_px("scene", fx, fy);
+    if (is_bg(s0r, s0g, s0b))
+        printf("   [warn] expected FAB ink at scene, got bg — geometry assumptions off\n");
+    /* 旧式局部重绘：清底+只画进度条（复现根因） */
+    {
+        const meow_theme *th = meow_theme_get();
+        meow_progress_set(g_dprc, 30);
+        meow_ui_fill_rect(r_prc.x, r_prc.y, r_prc.w, r_prc.h, th->bg);
+        meow_widget_draw(g_dprc);
+        meow_ui_flush_region(r_prc.x, r_prc.y, r_prc.w, r_prc.h);
+    }
+    int obr, obg, obb; rd_px(fx, fy, &obr, &obg, &obb);
+    printf("P1 old-partial (clear+single draw) "); pr_px("old", fx, fy);
+    if (is_bg(obr, obg, obb)) printf("   [BUG-CONFIRMED] old path erased FAB overlap (bg)\n");
+    else printf("   [note] old path did NOT erase FAB here (color %02X%02X%02X)\n", obr, obg, obb);
+
+    /* 新式局部重绘（真实 hello d_redraw → d_paint_region，重画重叠栈）*/
+    demo_paint();                                     /* 还原场景 */
+    meow_progress_set(g_dprc, 30);
+    d_redraw(g_dprc, r_prc);                          /* hello 的局部重绘入口 */
+    int nbr, nbg, nbb; rd_px(fx, fy, &nbr, &nbg, &nbb);
+    printf("P1 new-partial (d_redraw stack) "); pr_px("new", fx, fy);
+    if (near(s0r, nbr) && near(s0g, nbg) && near(s0b, nbb))
+        printf("   P1-PASS FAB preserved over live progress redraw\n");
+    else { printf("   P1-FAIL FAB not preserved (scene %02X%02X%02X vs new %02X%02X%02X)\n",
+                  s0r, s0g, s0b, nbr, nbg, nbb); fails++; }
+
+    /* ================= P2：列表焦点按本次触摸绑定/释放 =================
+     * demo_touch_down 命中非 list 区域时应释放列表焦点 → 页滚动，而不是继续滚列表。 */
+    g_demo_focus = 1;                                 /* 模拟此前点过列表（焦点留存） */
+    g_demo = 1;                                       /* demo 页已进入（demo_touch_down 前置闸门） */
+    demo_touch_down(240, 300);                        /* 非 list 非 slider 的内容区 */
+    printf("P2 touch_down(240,300) with focus=1 -> drag_list=%d drag_page=%d focus=%d\n",
+           g_drag_list, g_drag_page, g_demo_focus);
+    if (g_drag_list == 0 && g_drag_page == 1 && g_demo_focus == 0)
+        printf("   P2-PASS non-list touch releases focus, drags page\n");
+    else { printf("   P2-FAIL (expected drag_page=1 focus=0; got drag_list=%d drag_page=%d focus=%d)\n",
+                  g_drag_list, g_drag_page, g_demo_focus); fails++; }
+
+    /* ================= P3：列表滚动 W_LIST 视口外泄漏 =================
+     * 把页面 scroll 拉到底，列表上屏；再把列表 scroll 设非整行倍数 + 选中一个跨底/跨顶行，
+     * 观察视口外（标题间隙/底缘下）是否漏出选中行填充（标脏泄漏 = 标题栏/底部卡脏区）。 */
+    demo_rebuild_to(100000);                          /* clamp 到 max，列表上屏 */
+    printf("P3 list rect = (%d,%d,%d,%d)\n", r_list.x, r_list.y, r_list.w, r_list.h);
+    /* 顶部泄漏：选中行0 + scroll=20 → 行0 ry=top-20，填充越顶泄漏 */
+    meow_list_set_selected(g_dlc, 0); meow_list_set_scroll(g_dlc, 20);
+    d_redraw(g_dlc, r_list);
+    int ux = r_list.x + 10, uy = r_list.y - 5;        /* 列表顶上方 5px（标题间隙） */
+    int ur, ug, ub; rd_px(ux, uy, &ur, &ug, &ub);
+    printf("P3 top-leak "); pr_px("above-top", ux, uy);
+    if (is_bg(ur, ug, ub)) printf("   P3-top-PASS no leak into title gap\n");
+    else { printf("   P3-top-FAIL leaked into title gap\n"); fails++; }
+    /* 底部泄漏：选中行4 + scroll=20 → 行4 ry=590..630 越底泄漏 */
+    meow_list_set_selected(g_dlc, 4); meow_list_set_scroll(g_dlc, 20);
+    d_redraw(g_dlc, r_list);
+    int dx = r_list.x + 10, dy_ = r_list.y + r_list.h + 5;  /* 列表底下方 5px */
+    int dr, dg, db; rd_px(dx, dy_, &dr, &dg, &db);
+    printf("P3 bot-leak "); pr_px("below-bottom", dx, dy_);
+    if (is_bg(dr, dg, db)) printf("   P3-bottom-PASS no leak below list\n");
+    else { printf("   P3-bottom-FAIL leaked below list\n"); fails++; }
+
+    printf(fails ? "\nRESULT: %d FAIL(S)\n" : "\nRESULT: ALL PASS\n", fails);
+    return fails;
+}