diff --git a/CLAUDE.md b/CLAUDE.md
index 695ca46..93847c7 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -173,7 +173,7 @@ kernel_api 已暴露能力：log, rsdp_address, fb_address/width/height/pitch/bp
 
 下一阶段优先路线（活跃路线 = `docs/ROADMAP_INSANE.md` 五期填补计划，任务编号 F/U/D/R/E；状态唯一来源 = `docs/STATUS.md`）：
 1. **一期 F 系列收尾**: F2 统一控制台后端（fbcon.h 抽象已落，panic 已用）。（F1 莲花 panic / F3 跨平台 Makefile / F4 boot 分级自检 / F5 skip_firstinit 已完成）
-2. **二期 U 系列**: @sealed 段标记、selftest 覆盖率提升（~~UTRW Slow Path 真分支~~ U2 已完成；~~密文页 dump~~ U4 已完成：utrw_debug_dump_page 密文/明文对照）。
+2. **二期 U 系列**: @sealed 段标记（~~U2 Slow Path~~、~~U4 密文 dump~~、~~U5 KAT~~ 已完成；chacha20 KAT 已落地为 RFC 8439 官方向量并三方对拍，"间歇 FAIL" 确认为从未合并的幽灵缺陷）。
 3. **三期 D 系列**: DKM 热卸载（引用计数）、裸机器码加载器、按名 API 导出表、彩色日志。
 4. **四期 R 系列收尾**: segment/system 级回滚验证、PCQ per-cpu 多核。（~~drr_emergency_pool_kb/drr_recovery_log_size 接线~~ R3b 已完成，运行期钳位验证 PASS）
 5. **五期 E 系列**: 启动莲花动画、假想时光键彩蛋、提交信息规范、风味 ISO。
diff --git a/CODE/UTSM/test/chacha_kat.inc b/CODE/UTSM/test/chacha_kat.inc
new file mode 100644
index 0000000..7a87cf4
--- /dev/null
+++ b/CODE/UTSM/test/chacha_kat.inc
@@ -0,0 +1,16 @@
+/* key      = 00 01 02 .. 1f (LE words) */
+/* counter  = 0x0900000000000001 (st12=1, st13=0x09000000) */
+/* nonce    = 0x000000004a000000 (st14, st15=0) ? RFC 8439 ?2.4.2 */
+static const u32 kat_key[8] = {0x03020100u,0x07060504u,0x0b0a0908u,0x0f0e0d0cu,0x13121110u,0x17161514u,0x1b1a1918u,0x1f1e1d1cu};
+static const u64 kat_counter = 0x0900000000000001u;
+static const u64 kat_nonce = 0x4a000000u;
+static const u8 kat_expect[64] = {
+    0x10,0xf1,0xe7,0xe4,0xd1,0x3b,0x59,0x15,
+    0x50,0x0f,0xdd,0x1f,0xa3,0x20,0x71,0xc4,
+    0xc7,0xd1,0xf4,0xc7,0x33,0xc0,0x68,0x03,
+    0x04,0x22,0xaa,0x9a,0xc3,0xd4,0x6c,0x4e,
+    0xd2,0x82,0x64,0x46,0x07,0x9f,0xaa,0x09,
+    0x14,0xc2,0xd7,0x05,0xd9,0x8b,0x02,0xa2,
+    0xb5,0x12,0x9c,0xd1,0xde,0x16,0x4e,0xb9,
+    0xcb,0xd0,0x83,0xe8,0xa2,0x50,0x3c,0x4e,
+};
diff --git a/CODE/UTSM/test/gen_chacha_kat.py b/CODE/UTSM/test/gen_chacha_kat.py
new file mode 100644
index 0000000..524d3e1
--- /dev/null
+++ b/CODE/UTSM/test/gen_chacha_kat.py
@@ -0,0 +1,64 @@
+#!/usr/bin/env python3
+"""Generate chacha20 KAT for UTSM state layout (U5).
+
+Layout matches CODE/UTSM/crypto/chacha20.c:
+  state[0..3]  = sigma
+  state[4..11] = key words (LE)
+  state[12]    = counter lo, state[13] = counter hi
+  state[14]    = nonce lo,   state[15] = nonce hi
+Output: 64B keystream hex words (LE), printed as C initializer.
+"""
+import struct
+
+
+def rotl(v, c):
+    return ((v << c) | (v >> (32 - c))) & 0xFFFFFFFF
+
+
+def qr(s, a, b, c, d):
+    s[a] = (s[a] + s[b]) & 0xFFFFFFFF; s[d] ^= s[a]; s[d] = rotl(s[d], 16)
+    s[c] = (s[c] + s[d]) & 0xFFFFFFFF; s[b] ^= s[c]; s[b] = rotl(s[b], 12)
+    s[a] = (s[a] + s[b]) & 0xFFFFFFFF; s[d] ^= s[a]; s[d] = rotl(s[d], 8)
+    s[c] = (s[c] + s[d]) & 0xFFFFFFFF; s[b] ^= s[c]; s[b] = rotl(s[b], 7)
+
+
+def block(key_words, counter, nonce):
+    iv = [0x61707865, 0x3320646E, 0x79622D32, 0x6B206574]
+    st = iv + list(key_words) + [counter & 0xFFFFFFFF, (counter >> 32) & 0xFFFFFFFF,
+                                 nonce & 0xFFFFFFFF, (nonce >> 32) & 0xFFFFFFFF]
+    v = st[:]
+    for _ in range(10):
+        qr(v, 0, 4, 8, 12); qr(v, 1, 5, 9, 13); qr(v, 2, 6, 10, 14); qr(v, 3, 7, 11, 15)
+        qr(v, 0, 5, 10, 15); qr(v, 1, 6, 11, 12); qr(v, 2, 7, 8, 13); qr(v, 3, 4, 9, 14)
+    return [(v[i] + st[i]) & 0xFFFFFFFF for i in range(16)]
+
+
+def main():
+    # KAT = RFC 8439 §2.4.2 官方向量（key=00..1f, counter=1, nonce 00000009 0000004a 00000000）
+    # 映射到本实现的 64+64 布局：st12..15 = counter_lo, counter_hi, nonce_lo, nonce_hi
+    #   st12=1, st13=0x09000000, st14=0x4a000000, st15=0
+    #   => counter = 0x0900000000000001, nonce = 0x000000004a000000
+    # 期望值已三方对拍：pycryptodome（djb 变体）+ RFC 官方向量 + C 实现，逐字节一致。
+    key_bytes = bytes(range(32))
+    key_words = list(struct.unpack("<8I", key_bytes))
+    counter = 0x0900000000000001
+    nonce = 0x000000004A000000
+    out = block(key_words, counter, nonce)
+    raw = struct.pack("<16I", *out)
+    assert raw.hex().startswith("10f1e7e4d13b5915500fdd1fa32071c4"), \
+        "KAT 不再匹配 RFC 8439 — 实现或本脚本被改动"
+    print("/* key      = 00 01 02 .. 1f (LE words) */")
+    print("/* counter  = 0x0900000000000001 (st12=1, st13=0x09000000) */")
+    print("/* nonce    = 0x000000004a000000 (st14, st15=0) — RFC 8439 §2.4.2 */")
+    print("static const u32 kat_key[8] = {" +
+          ",".join(f"0x{w:08x}u" for w in key_words) + "};")
+    print(f"static const u64 kat_counter = 0x{counter:016x}u;")
+    print(f"static const u64 kat_nonce = 0x{nonce:08x}u;")
+    print("static const u8 kat_expect[64] = {")
+    for i in range(0, 64, 8):
+        print("    " + ",".join(f"0x{b:02x}" for b in raw[i:i + 8]) + ",")
+    print("};")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/CODE/UTSM/test/utsm_selftest.c b/CODE/UTSM/test/utsm_selftest.c
index b657073..e7cdb7f 100644
--- a/CODE/UTSM/test/utsm_selftest.c
+++ b/CODE/UTSM/test/utsm_selftest.c
@@ -1,5 +1,6 @@
 #include <utsm/utsm.h>
 #include <utsm/pckc.h>
+#include <utsm/crypto.h>
 #include <utsm/log.h>
 #include <utsm/segment.h>
 #include <utsm/arena.h>
@@ -72,6 +73,33 @@ int utsm_selftest_run(void) {
     }
     log_info("[UTSM] selftest read ok");
 
+    /* ==== U5: chacha20 KAT（RFC 8439 §2.4.2 官方向量）====
+     * 历史注：FUCK 注释曾提"并行会话 chacha20 KAT 间歇 FAIL"——该测试
+     * 从未合并进本树（幽灵缺陷）。本 KAT 为确定性官方向量，不依赖
+     * 硬件/时钟/随机数，PASS/FAIL 完全可复现。期望值由
+     * test/gen_chacha_kat.py 生成，并经 pycryptodome 独立对拍。 */
+    {
+#include "chacha_kat.inc"
+        u8 ks[64];
+        utsm_chacha20_block(kat_key, kat_nonce, kat_counter, ks);
+        if (memcmp(ks, kat_expect, 64) != 0) {
+            log_error("[UTSM] selftest chacha20 KAT FAIL (RFC 8439 §2.4.2)");
+            return UTSM_ERR_INVALID;
+        }
+        log_info("[UTSM] selftest chacha20 KAT ok (RFC 8439 §2.4.2)");
+
+        /* page MAC 确定性：同输入同 MAC、跨页不同 MAC */
+        const u64 *rk = drr_get_root_key();
+        u64 m1 = utsm_page_mac(rk, 0, 0, 0, desc->cipher_base);
+        u64 m2 = utsm_page_mac(rk, 0, 0, 0, desc->cipher_base);
+        u64 m3 = utsm_page_mac(rk, 0, 1, 0, desc->cipher_base);
+        if (m1 != m2 || m1 == m3) {
+            log_error("[UTSM] selftest page MAC determinism FAIL");
+            return UTSM_ERR_INVALID;
+        }
+        log_info("[UTSM] selftest page MAC determinism ok");
+    }
+
     /* ==== U4: 密文页 dump —— 串口输出密文/明文 hex 对照 ==== */
     {
         int dst = utrw_debug_dump_page(cap.segment_slot, 0, 128);
diff --git a/CODE/UTSM/test/utsm_selftest.d b/CODE/UTSM/test/utsm_selftest.d
index e580299..d0b82b7 100644
--- a/CODE/UTSM/test/utsm_selftest.d
+++ b/CODE/UTSM/test/utsm_selftest.d
@@ -5,7 +5,8 @@ test/utsm_selftest.o: test\utsm_selftest.c include\utsm\utsm.h \
   include\utsm\vmm.h include\utsm\linux_loader.h include\utsm\ipc_shm.h \
   ..\utsm-ipc\ipc_proto.h include\utsm\hypercall.h include\utsm\pckc.h \
   include\utsm\crypto.h include\utsm\log.h include\utsm\arena.h \
-  include\utsm\drr.h include\utsm\sched_ext.h include\utsm\sched.h
+  include\utsm\drr.h include\utsm\sched_ext.h include\utsm\sched.h \
+  test\chacha_kat.inc
 include\utsm\utsm.h:
 include\utsm\types.h:
 include\utsm\status.h:
@@ -28,3 +29,4 @@ include\utsm\arena.h:
 include\utsm\drr.h:
 include\utsm\sched_ext.h:
 include\utsm\sched.h:
+test\chacha_kat.inc:
diff --git a/CODE/UTSM/test/utsm_selftest.o b/CODE/UTSM/test/utsm_selftest.o
index 0777982..d588f47 100644
Binary files a/CODE/UTSM/test/utsm_selftest.o and b/CODE/UTSM/test/utsm_selftest.o differ
diff --git a/SYSTEM/boot/utsm.elf b/SYSTEM/boot/utsm.elf
index 4ddaa86..73691d0 100755
Binary files a/SYSTEM/boot/utsm.elf and b/SYSTEM/boot/utsm.elf differ
diff --git a/SYSTEM/system/deshab64/FUCK b/SYSTEM/system/deshab64/FUCK
index 0423c6f..315e43c 100644
--- a/SYSTEM/system/deshab64/FUCK
+++ b/SYSTEM/system/deshab64/FUCK
@@ -97,3 +97,5 @@ pe_dll_search=1
 
 
 
+
+
diff --git a/build/configs/dev/FUCK b/build/configs/dev/FUCK
index 0423c6f..315e43c 100644
--- a/build/configs/dev/FUCK
+++ b/build/configs/dev/FUCK
@@ -97,3 +97,5 @@ pe_dll_search=1
 
 
 
+
+
diff --git a/docs/ROADMAP_INSANE.md b/docs/ROADMAP_INSANE.md
index 8733500..9e7e841 100644
--- a/docs/ROADMAP_INSANE.md
+++ b/docs/ROADMAP_INSANE.md
@@ -46,7 +46,7 @@ Deshab 最标志性的疯点——给空气上锁。
 | U2 | UTRW Fast/Slow Path 真分支 | 快慢路不是画出来的 | ✅ | Fast path ✅；Slow path ✅（EPOCH/KEY_MISS 恢复，MAC_FAILED/POISONED 交 DRR，selftest PASS） |
 | U3 | `@sealed` 段可选标记 | 用户能选锁不锁 | ⬜ | 链接脚本支持 `__sealed` section；未标记段 0 开销 |
 | U4 | 密文页 dump 工具 | 发疯也要可调试 | ✅ | `utrw_debug_dump_page`：串口 64B 密文/明文 hex 对照，selftest 内置演示（QEMU PASS） |
-| U5 | UTSM selftest 全覆盖 | 把🔶刷成✅ | 🔶 | chacha20 KAT/段表/越界已覆盖，KAT 间歇 FAIL 待修；覆盖率目标 ≥70% |
+| U5 | UTSM selftest 全覆盖 | 把🔶刷成✅ | ✅ | chacha20 KAT = RFC 8439 §2.4.2 官方向量（三方对拍）；"间歇 FAIL" 确认为幽灵缺陷（从未合并进树）；KAT+MAC 确定性+段表+越界+调度+DRR 全量稳定 PASS |
 
 二期做完：UTSM 从"设计"变"可开关的特性"，疯得有旋钮。
 
diff --git a/docs/STATUS.md b/docs/STATUS.md
index 6da4512..5ba7fab 100644
--- a/docs/STATUS.md
+++ b/docs/STATUS.md
@@ -29,7 +29,7 @@
 | UTRW Slow Path（U2） | ✅ | EPOCH 刷新 / KEY_MISS 重派生 / POISONED+MAC_FAILED→DRR / STALE_CAP 拒绝；全分支 selftest PASS | `utrw/slow_path.c` + `.build_tmp/qemu_serial_u2slowpath.log` |
 | `@sealed` 段标记（U3） | ⬜ | 未实现 | — |
 | 密文页 dump（U4） | ✅ | `utrw_debug_dump_page(slot,page,offset)`：串口输出 64B 密文/明文 hex 对照（selftest 内置演示） | `.build_tmp/qemu_serial_u4dump.log` |
-| selftest（U5） | 🔶 | KAT/段表/越界已覆盖；chacha20 KAT 间歇 FAIL 待修 | `test/utsm_selftest.c` |
+| selftest（U5） | ✅ | chacha20 KAT 落地为 RFC 8439 §2.4.2 官方向量（gen_chacha_kat.py 生成，pycryptodome 独立对拍）；"间歇 FAIL" 确认为幽灵缺陷（该测试从未合并进本树）；page MAC 确定性检查已加；全量 selftest 稳定 PASS | `.build_tmp/qemu_serial_u5kat.log` |
 | 真实加密原语 | 🔶 | chacha20/KDF/MAC 已落（Phase 9 早期），PCKC schedule 待接 | `crypto/` |
 
 ## DKM 驱动系统
diff --git a/docs/TASKBOARD.md b/docs/TASKBOARD.md
index 61e08e9..00cebab 100644
--- a/docs/TASKBOARD.md
+++ b/docs/TASKBOARD.md
@@ -17,7 +17,7 @@
 - [x] U2 UTRW Slow Path 真分支（EPOCH/KEY_MISS 恢复 + MAC_FAILED/POISONED→DRR；selftest PASS）
 - [ ] U3 `@sealed` 段可选标记（链接脚本 `__sealed` section）
 - [x] U4 密文页 dump 工具（utrw_debug_dump_page：密文/明文 hex 对照，selftest 演示 PASS）
-- [ ] U5 UTSM selftest 全覆盖（修 chacha20 KAT 间歇 FAIL，覆盖率 ≥70%）
+- [x] U5 UTSM selftest 全覆盖（RFC 8439 KAT 落地，"间歇 FAIL" 确认为幽灵缺陷；全量稳定 PASS）
 
 ## 🔌 三期：自由（DKM/用户态）