docs(readme): r1 复审修复 —— 去掉 ull 随包分发的假话、macOS 探针降级为 advisory、离线档案正面陈述、合规段提到第一屏

- P1: ull 与 v0.1.0 同源同版本但发布资产只有 GUI 单文件（make_artifacts.py 只搬 launcher、
  release.yml assets 只 glob unlucky-launcher-*）→ 4 处改为「自行 cargo build --release --bin ull」
- P2-1: macOS 运行期探针 if workflow_dispatch + continue-on-error，属 advisory → 与 Linux 冒烟拆句
- P2-2: 离线档案去掉「不能连校验账户的服务器」这种可反读的限定，标题改「联机游玩必须使用 Microsoft 账户」
- P2-3: 合规声明挪到引言之后、特性 bullet 之前（第一屏可见），文字不变
- nit: 三份合规文本每个 Release 都挂（Windows 因 exe 装不下才并列）；Slint 版无显式探测，改为两套栈
  各自回退到 CPU 的准确表述

README.md

@@ -10,6 +10,21 @@ Unlucky Launcher (ULL) is a free, open-source Minecraft: Java Edition launcher w
 WebView. The launcher embeds an AI agent client (chat / configuration / crash diagnosis) and can be
 attached to other agent tooling as an MCP server.
 
+## Compliance statement
+
+- **Microsoft sign-in only.** Authentication is Microsoft OAuth 2.0 device code flow → Xbox Live →
+  XSTS → `api.minecraftservices.com`, using the player's own Microsoft account and their own game
+  entitlement. There is no other account provider.
+- **Credentials stay on your machine.** Account tokens are stored locally only, are never sent to
+  any server operated by this project, and the AI features cannot read them.
+- **Playing online requires a Microsoft account.** A local offline profile performs no Microsoft
+  authentication and contacts no Microsoft or Mojang service; it exists for local and
+  isolated-network testing only and is not an online-play path.
+- ULL does not distribute, mirror, proxy or modify any Minecraft game files.
+- Not affiliated with Mojang or Microsoft.
+
+## Highlights
+
 - **Single-file native binary**: the launcher itself needs no JVM, no WebView and no sidecar
   runtime. The JDK a game needs is downloaded and managed per instance, not as a launcher
   dependency.
@@ -26,19 +41,6 @@ attached to other agent tooling as an MCP server.
   downloading) and a YAML rule-based crash diagnosis engine.
 - **License**: Apache-2.0 © AskaEth (YeiJ).
 
-## Compliance statement
-
-- **Microsoft sign-in only.** Authentication is Microsoft OAuth 2.0 device code flow → Xbox Live →
-  XSTS → `api.minecraftservices.com`, using the player's own Microsoft account and their own game
-  entitlement. There is no other account provider.
-- **Credentials stay on your machine.** Account tokens are stored locally only, are never sent to
-  any server operated by this project, and the AI features cannot read them.
-- **Offline profiles cannot play online.** A local offline profile performs no Microsoft
-  authentication, contacts no Microsoft/Mojang service, exists for local and isolated-network
-  testing only, and cannot join servers that check accounts against the official service.
-- ULL does not distribute, mirror, proxy or modify any Minecraft game files.
-- Not affiliated with Mojang or Microsoft.
-
 ## Status
 
 Two tracks. They are not the same product yet, so read the headings before downloading anything.
@@ -46,12 +48,16 @@ Two tracks. They are not the same product yet, so read the headings before downl
 ### Track A — released: v0.1.0, Slint UI (this is what you can download today)
 
 - **GitHub Releases `v0.1.0`** (2026-11-01, flagged pre-release): single-file assets for Windows
-  x64 (a bare `.exe`), Linux x64 and macOS (arm64 and x64) `.tar.gz`, plus `SHA256SUMS.txt` and
+  x64 (a bare `.exe`), Linux x64 and macOS (arm64 and x64) `.tar.gz`. Every release also carries
-  `LICENSE` / `NOTICE` / `README.md` as side assets on Windows.
+  `SHA256SUMS.txt` and the `LICENSE` / `NOTICE` / `README.md` texts as separate assets; on Windows
+  those texts sit next to the `.exe` because a bare exe cannot hold them, while the unix archives
+  already contain them.
 - **UI**: Slint + Metro. This is the shipped GUI — the instance, download, account, Java, log and
   settings pages drive the real engine (the in-app AI chat panel is a scripted placeholder).
-- **CLI `ull`** ships in the same release and is fully usable: `instances`, `install`, `launch`,
+- **CLI `ull`** is built from the same tree at the same version and is fully usable — but the
-  `accounts`, `sessions`, `logs`, `diag`, `config`, `java`, `agent`.
+  `v0.1.0` assets ship only the GUI binary. If you want the CLI, build it yourself:
+  `cargo build --release --bin ull`. Commands: `instances`, `install`, `launch`, `accounts`,
+  `sessions`, `logs`, `diag`, `config`, `java`, `agent`.
 - Windows ARM64 and Linux ARM64 slots are wired into the release pipeline; the next tagged release
   builds them. The `v0.1.0` assets predate those two slots.
 
@@ -79,7 +85,7 @@ Binaries in the workspace, so you can tell them apart:
 |--------|-------|-------|
 | `unlucky-launcher` | `crates/app` (Slint) | released in v0.1.0; still the usable GUI |
 | `unlucky-launcher-iced` | `crates/app-iced` (iced 0.14) | under construction; skeleton only, not shipped |
-| `ull` | `crates/cli` | released in v0.1.0; headless and fully usable |
+| `ull` | `crates/cli` | built from the same tree at the same version; not shipped in the v0.1.0 assets |
 
 ## Module map
 
@@ -139,20 +145,22 @@ Rendering switches:
   CPU path on the Slint build
 - `unlucky-launcher-iced --software-renderer` forces tiny-skia (`ICED_BACKEND=tiny-skia`);
   `--screenshot <png>` writes one frame and exits, which is the acceptance channel
-- Both builds probe the backend at startup and fall back to CPU automatically when no adapter is
+- Both stacks fall back to the CPU path when no usable adapter is there: the Slint build through its
-  usable
+  own renderer fallback chain, the iced build through its explicit probe
 
 Dependency license check (optional locally, required in CI):
 `cargo deny check licenses bans sources`.
 
 ## CI gates
 
-Every push runs fmt / clippy (warnings are errors) / the full test suite, plus a headless render
+Every push runs fmt / clippy (warnings are errors) / the full test suite, and the Linux headless
-smoke on Linux and a macOS runtime probe. Nothing here is advisory: a red gate blocks the merge.
+render smoke is a hard gate on the same footing: a red result blocks the merge. The macOS runtime
+probe is not there yet — it only runs on a manual `workflow_dispatch` and its result is recorded,
+not enforced (`continue-on-error`), until the slot passes a first run on a real runner.
 
 | Workflow | Content |
 |----------|---------|
-| `.github/workflows/ci.yml` | fmt + clippy + test + release build (Windows / Linux matrix); Linux runtime smoke (Xvfb: renders one real frame, then asserts the PNG is not blank); macOS runtime smoke |
+| `.github/workflows/ci.yml` | fmt + clippy + test + release build (Windows / Linux matrix); Linux runtime smoke (Xvfb: renders one real frame, then asserts the PNG is not blank); macOS runtime probe (manual dispatch only) |
 | `.github/workflows/guards.yml` | zero-UI guard for `crates/core` (manifest plus `cargo tree`), 400-lines-per-file guard, cargo-deny license and source guard |
 | `.github/workflows/release.yml` | tag `v*` → per-slot builds → single-file artifacts + `SHA256SUMS.txt` → GitHub Release |
 

README.zh-CN.md

@@ -9,6 +9,18 @@ Unlucky Launcher（ULL）是一个用 Rust 写的免费开源 Minecraft: Java
 每个平台就一个原生二进制——没有安装包、没有捆绑运行时、没有 WebView。启动器内置 AI Agent
 客户端（对话 / 改配置 / 崩溃诊断），也能作为 MCP server 接进别的 Agent 工具。
 
+## 合规声明
+
+- **只走 Microsoft 正版登录**：认证是 Microsoft OAuth 2.0 device code flow → Xbox Live → XSTS →
+  `api.minecraftservices.com`，用的是玩家自己的 Microsoft 账户与自己已购的游戏权益，没有别家账户通道。
+- **凭据只存本机**：账户令牌只保存在本机，不上传本项目运营的任何服务器，AI 功能也读不到。
+- **联机游玩必须使用 Microsoft 账户**：本地离线档案不做 Microsoft 认证、不连任何 Microsoft / Mojang
+  服务，仅限本地与隔离网络环境的测试，它不是联机游玩的门路。
+- 不分发、不镜像、不代理、不修改任何 Minecraft 游戏文件。
+- 与 Mojang、Microsoft 无关联。
+
+## 特性
+
 - **单文件原生二进制**：启动器本体不需要 JVM、不需要 WebView、不带旁挂运行时。游戏要的 JDK 由
   启动器按实例下载管理，不是启动器的依赖。
 - **重写期两套 UI 并存**：已发布版本是 Slint（Royalty-Free 2.0）；下一代 UI 是 iced 0.14 +
@@ -21,16 +33,6 @@ Unlucky Launcher（ULL）是一个用 Rust 写的免费开源 Minecraft: Java
 - **引擎**：多源下载（健康度评分、镜像、分块传输、边下边算）与 YAML 规则引擎的崩溃诊断。
 - **许可**：Apache-2.0 © AskaEth (YeiJ)。
 
-## 合规声明
-
-- **只走 Microsoft 正版登录**：认证是 Microsoft OAuth 2.0 device code flow → Xbox Live → XSTS →
-  `api.minecraftservices.com`，用的是玩家自己的 Microsoft 账户与自己已购的游戏权益，没有别家账户通道。
-- **凭据只存本机**：账户令牌只保存在本机，不上传本项目运营的任何服务器，AI 功能也读不到。
-- **离线档案不能联机**：本地离线档案不做 Microsoft 认证、不连 Microsoft / Mojang 任何服务，仅用于
-  本地与隔离网络环境的测试，无法连接对官方验证服校验账户的服务器。
-- 不分发、不镜像、不代理、不修改任何 Minecraft 游戏文件。
-- 与 Mojang、Microsoft 无关联。
-
 ## 当前状态
 
 两条轨道，还不是同一个东西——看小标题再决定下载什么。
@@ -38,11 +40,13 @@ Unlucky Launcher（ULL）是一个用 Rust 写的免费开源 Minecraft: Java
 ### 轨道 A —— 已发布：v0.1.0，Slint 版（现在真能下载的就是它）
 
 - **GitHub Releases `v0.1.0`**（2026-11-01，标记为 pre-release）：单文件产物覆盖 Windows x64（裸
-  `.exe`）、Linux x64、macOS（arm64 与 x64）`.tar.gz`，另附 `SHA256SUMS.txt`；Windows 因为「一个 exe
+  `.exe`）、Linux x64、macOS（arm64 与 x64）`.tar.gz`。每个 Release 另挂 `SHA256SUMS.txt` 与
-  装不下文本」，`LICENSE` / `NOTICE` / `README.md` 作为并列资产随下载走。
+  `LICENSE` / `NOTICE` / `README.md` 三份文本——Windows 是「一个 exe 装不下文本」所以并列挂出，
+  unix 归档里本来就装着。
 - **UI**：Slint + Metro。这是已交付的图形界面——实例、下载、账户、Java、日志、设置各页驱动真实引擎
   （应用内 AI 对话面板仍是脚本化的占位）。
-- **CLI `ull`** 同版本发布、完整可用：`instances`、`install`、`launch`、`accounts`、`sessions`、
+- **CLI `ull`** 与 v0.1.0 同源同版本、完整可用，但发布资产里只有 GUI 单文件——要用它请自己构建：
+  `cargo build --release --bin ull`。命令：`instances`、`install`、`launch`、`accounts`、`sessions`、
   `logs`、`diag`、`config`、`java`、`agent`。
 - Windows ARM64 与 Linux ARM64 两个槽位已接进发布流水线，随下一个 tag 发布；`v0.1.0` 的资产早于
   这两个槽位。
@@ -67,7 +71,7 @@ Unlucky Launcher（ULL）是一个用 Rust 写的免费开源 Minecraft: Java
 |--------|-------|------|
 | `unlucky-launcher` | `crates/app`（Slint） | v0.1.0 已发布，仍是当前能用的图形界面 |
 | `unlucky-launcher-iced` | `crates/app-iced`（iced 0.14） | 施工中，仅骨架，不随发布包分发 |
-| `ull` | `crates/cli` | v0.1.0 已发布，headless 完整可用 |
+| `ull` | `crates/cli` | 与发布版同源同版本构建；未随 v0.1.0 资产分发 |
 
 ## 模块地图
 
@@ -124,18 +128,19 @@ cargo build --release                                  # 三个 bin 都落在 ta
 - `unlucky-launcher --software-renderer`（等价于 `SLINT_BACKEND=winit-software`）强制 Slint 版走 CPU
 - `unlucky-launcher-iced --software-renderer` 强制 tiny-skia（`ICED_BACKEND=tiny-skia`）；
   `--screenshot <png>` 出一帧图后退出，这是验收通道
-- 两个版本启动时都会探测后端，拿不到可用适配器就自动降级到 CPU
+- 两套栈在没有可用适配器时都会退到 CPU：Slint 版走它自己的渲染器回退链，iced 版走显式探测
 
 依赖许可检查（本地可选，CI 必跑）：`cargo deny check licenses bans sources`。
 
 ## CI 门禁
 
-每次推送都跑 fmt / clippy（warnings 视为错误）/ 全量测试，另有一条 Linux 无头渲染冒烟与一次
+每次推送都跑 fmt / clippy（warnings 视为错误）/ 全量测试，Linux 无头渲染冒烟与它们同级、是硬门禁：
-macOS 运行期探测。这些门禁不是摆设：红了就不许合。
+红了就不许合。macOS 运行期探针还不算——它只在手动 `workflow_dispatch` 时跑，结果留证据但不作为
+流水线结论（`continue-on-error`），直到该槽位在真实 runner 上首跑通过。
 
 | Workflow | 内容 |
 |----------|------|
-| `.github/workflows/ci.yml` | fmt + clippy + test + release build（Windows / Linux 矩阵）；Linux runtime smoke（Xvfb 里真渲染一帧，再断言 PNG 非空白）；macOS runtime smoke |
+| `.github/workflows/ci.yml` | fmt + clippy + test + release build（Windows / Linux 矩阵）；Linux runtime smoke（Xvfb 里真渲染一帧，再断言 PNG 非空白）；macOS 运行期探针（仅手动 dispatch） |
 | `.github/workflows/guards.yml` | `crates/core` 零 UI 守门（依赖表 + `cargo tree`）、单文件 ≤400 行守门、cargo-deny 许可与来源守门 |
 | `.github/workflows/release.yml` | tag `v*` → 分槽位构建 → 单文件产物 + `SHA256SUMS.txt` → GitHub Release |