diff --git a/chv-guest/build.sh b/chv-guest/build.sh
index b82e335..05e22a1 100755
--- a/chv-guest/build.sh
+++ b/chv-guest/build.sh
@@ -149,32 +149,35 @@ else
 fi
 run qemu-img convert -f qcow2 -O raw "$IMG" "$OUT/disk.raw"
 # 清单软件（照抄 cloud/docker/Dockerfile 的 apt/pip 清单，
-# 中文 LaTeX xelatex+CJK 故意不装，见 README；Playwright
-# 默认不装，PLAYWRIGHT=1 时才加装，属可选步骤）。
-run virt-customize -a "$OUT/disk.raw" \
-  --install git,pandoc,poppler-utils,latexmk,texlive-latex-base,openssh-server,cloud-init,qemu-guest-agent,python3,python3-pip \
-  --run-command 'pip3 install --no-cache-dir --break-system-packages python-docx openpyxl python-pptx PyMuPDF Pillow || pip3 install --no-cache-dir python-docx openpyxl python-pptx PyMuPDF Pillow' \
-  --copy-in "$CODEX_BIN_DIR/codex:/usr/local/bin/" \
-  --copy-in "$CODEX_BIN_DIR/codex-code-mode-host:/usr/local/bin/" \
-  --copy-in "$CODEX_BIN_DIR/codex-resources:/usr/local/bin/" \
-  --run-command 'chmod +x /usr/local/bin/codex /usr/local/bin/codex-code-mode-host; ln -sf /usr/local/bin/codex-resources/bwrap /usr/local/bin/bwrap' \
-  --mkdir /app \
-  --copy-in "$REPO_DIR/host.py:/app/" \
-  --copy-in "$REPO_DIR/cloud:/app/" \
-  --run-command 'printf "ssh_deletekeys: false\nssh_genkeytypes: []\n" > /etc/cloud/cloud.cfg.d/99-chv-hostkey.cfg; systemctl enable ssh || true' \
-  --run-command 'printf "PasswordAuthentication no\nPermitRootLogin prohibit-password\nChallengeResponseAuthentication no\nKbdInteractiveAuthentication no\nPubkeyAuthentication yes\n" > /etc/ssh/sshd_config.d/99-chv.conf && mkdir -p /run/sshd && ssh-keygen -A && sshd -t && grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config.d/99-chv.conf && grep -q "^PermitRootLogin prohibit-password" /etc/ssh/sshd_config.d/99-chv.conf && rm -f /etc/ssh/ssh_host_* && test -z "$(ls /etc/ssh/ssh_host_* 2>/dev/null)"' \
-  --run-command 'dpkg-query -W -f "${Package} ${Version}\n" > /app/guest-versions-dpkg.txt; pip3 freeze > /app/guest-versions-pip.txt || true'
-if [ "${PLAYWRIGHT:-0}" = "1" ]; then
-  run virt-customize -a "$OUT/disk.raw" \
+# 中文 LaTeX xelatex 故意不装，见 README；fonts-noto-cjk 只
+# 是浏览器渲染用的中文字体，不是 LaTeX。Playwright 默认开启
+# （PLAYWRIGHT=0 可显式关掉），浏览器常驻复用）。
+# 单次 virt-customize：apt 安装、pip、拷入、sshd 加固、版本
+# 读回都在同一次定制里按参数顺序跑；Playwright 装在第一次
+# freeze 之后、最终 freeze 之前（B-08：最终 freeze 须在
+# Playwright 安装之后，否则 BUILDINFO.versions.pip 里没有
+# playwright；Chromium 版本以 ms-playwright 缓存目录名记录
+# （如 chromium-1200），写进 /app/guest-versions-chromium.txt）。
+VC_ARGS=(-a "$OUT/disk.raw"
+  --install git,pandoc,poppler-utils,latexmk,texlive-latex-base,openssh-server,cloud-init,qemu-guest-agent,python3,python3-pip,fonts-noto-cjk
+  --run-command 'pip3 install --no-cache-dir --break-system-packages python-docx openpyxl python-pptx PyMuPDF Pillow || pip3 install --no-cache-dir python-docx openpyxl python-pptx PyMuPDF Pillow'
+  --copy-in "$CODEX_BIN_DIR/codex:/usr/local/bin/"
+  --copy-in "$CODEX_BIN_DIR/codex-code-mode-host:/usr/local/bin/"
+  --copy-in "$CODEX_BIN_DIR/codex-resources:/usr/local/bin/"
+  --run-command 'chmod +x /usr/local/bin/codex /usr/local/bin/codex-code-mode-host; ln -sf /usr/local/bin/codex-resources/bwrap /usr/local/bin/bwrap'
+  --mkdir /app
+  --copy-in "$REPO_DIR/host.py:/app/"
+  --copy-in "$REPO_DIR/cloud:/app/"
+  --run-command 'printf "ssh_deletekeys: false\nssh_genkeytypes: []\n" > /etc/cloud/cloud.cfg.d/99-chv-hostkey.cfg; systemctl enable ssh || true'
+  --run-command 'printf "PasswordAuthentication no\nPermitRootLogin prohibit-password\nChallengeResponseAuthentication no\nKbdInteractiveAuthentication no\nPubkeyAuthentication yes\n" > /etc/ssh/sshd_config.d/99-chv.conf && mkdir -p /run/sshd && ssh-keygen -A && sshd -t && grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config.d/99-chv.conf && grep -q "^PermitRootLogin prohibit-password" /etc/ssh/sshd_config.d/99-chv.conf && rm -f /etc/ssh/ssh_host_* && test -z "$(ls /etc/ssh/ssh_host_* 2>/dev/null)"'
+  --run-command 'dpkg-query -W -f "${Package} ${Version}\n" > /app/guest-versions-dpkg.txt; pip3 freeze > /app/guest-versions-pip.txt || true')
+if [ "${PLAYWRIGHT:-1}" = "1" ]; then
+  VC_ARGS+=(
     --run-command 'pip3 install --no-cache-dir playwright; python3 -m playwright install --with-deps chromium'
-  # B-08：pip freeze 是在第一次定制时写的，Playwright 装在第二次
-  # 定制，须重写 freeze，否则 BUILDINFO.versions.pip 里没有
-  # playwright；Chromium 版本以 ms-playwright 缓存目录名记录
-  # （如 chromium-1200），写进 /app/guest-versions-chromium.txt。
-  run virt-customize -a "$OUT/disk.raw" \
-    --run-command 'dpkg-query -W -f "${Package} ${Version}\n" > /app/guest-versions-dpkg.txt; pip3 freeze > /app/guest-versions-pip.txt || true' \
-    --run-command 'ls /root/.cache/ms-playwright/ > /app/guest-versions-chromium.txt 2>/dev/null || true'
+    --run-command 'dpkg-query -W -f "${Package} ${Version}\n" > /app/guest-versions-dpkg.txt; pip3 freeze > /app/guest-versions-pip.txt || true'
+    --run-command 'ls /root/.cache/ms-playwright/ > /app/guest-versions-chromium.txt 2>/dev/null || true')
 fi
+run virt-customize "${VC_ARGS[@]}"
 run virt-get-kernel -a "$OUT/disk.raw" -o "$OUT/vmlinux"
 # feat-chv-secfix（M4）：构建时把客机内实际装好的版本
 # 读回 BUILDINFO.versions（dpkg + pip freeze），名字列表
@@ -185,24 +188,24 @@ run virt-get-kernel -a "$OUT/disk.raw" -o "$OUT/vmlinux"
 if [ "$DRY_RUN" = "1" ]; then
   echo "DRY-RUN: virt-cat -a $OUT/disk.raw /app/guest-versions-dpkg.txt > $OUT/guest-versions-dpkg.txt"
   echo "DRY-RUN: virt-cat -a $OUT/disk.raw /app/guest-versions-pip.txt > $OUT/guest-versions-pip.txt"
-  if [ "${PLAYWRIGHT:-0}" = "1" ]; then
+  if [ "${PLAYWRIGHT:-1}" = "1" ]; then
     echo "DRY-RUN: virt-cat -a $OUT/disk.raw /app/guest-versions-chromium.txt > $OUT/guest-versions-chromium.txt"
   fi
 else
   virt-cat -a "$OUT/disk.raw" /app/guest-versions-dpkg.txt > "$OUT/guest-versions-dpkg.txt"
   virt-cat -a "$OUT/disk.raw" /app/guest-versions-pip.txt > "$OUT/guest-versions-pip.txt"
-  if [ "${PLAYWRIGHT:-0}" = "1" ]; then
+  if [ "${PLAYWRIGHT:-1}" = "1" ]; then
     virt-cat -a "$OUT/disk.raw" /app/guest-versions-chromium.txt > "$OUT/guest-versions-chromium.txt" || true
   fi
 fi
 # 产物校验（干跑只打印，不执行校验命令的副作用部分）。
 if [ "$DRY_RUN" = "1" ]; then
   echo "DRY-RUN: test -s $OUT/vmlinux && test -s $OUT/disk.raw"
-  echo "DRY-RUN: python3 $SCRIPT_DIR/buildinfo.py $OUT $TAG $UBUNTU_VERSION $CODEX_VERSION $REPO_COMMIT <sha256> ${PLAYWRIGHT:-0}"
+  echo "DRY-RUN: python3 $SCRIPT_DIR/buildinfo.py $OUT $TAG $UBUNTU_VERSION $CODEX_VERSION $REPO_COMMIT <sha256> ${PLAYWRIGHT:-1}"
 else
   test -s "$OUT/vmlinux" || { echo "内核产物为空：$OUT/vmlinux" >&2; exit 1; }
   test -s "$OUT/disk.raw" || { echo "磁盘产物为空：$OUT/disk.raw" >&2; exit 1; }
-  python3 "$SCRIPT_DIR/buildinfo.py" "$OUT" "$TAG" "$UBUNTU_VERSION" "$CODEX_VERSION" "$REPO_COMMIT" "$UBUNTU_IMAGE_SHA256" "${PLAYWRIGHT:-0}"
+  python3 "$SCRIPT_DIR/buildinfo.py" "$OUT" "$TAG" "$UBUNTU_VERSION" "$CODEX_VERSION" "$REPO_COMMIT" "$UBUNTU_IMAGE_SHA256" "${PLAYWRIGHT:-1}"
 fi
 echo "tag=$TAG"
 echo "out=$OUT"