diff --git a/build/install_full.sh b/build/install_full.sh
new file mode 100644
index 0000000..897dfb0
--- /dev/null
+++ b/build/install_full.sh
@@ -0,0 +1,78 @@
+#!/bin/bash
+set -euo pipefail
+
+# SafeLine WAF 完整版安装脚本
+# 使用官方二进制，包含完整 FVM WAF 功能
+
+INSTALL_DIR="${1:-/data/safeline}"
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+NC='\033[0m'
+
+info() { echo -e "${GREEN}[INFO]${NC} $*"; }
+error() { echo -e "${RED}[ERROR]${NC} $*"; exit 1; }
+
+if [ "$(id -u)" -ne 0 ]; then
+    error "需要 root 权限"
+fi
+
+if ! command -v docker &>/dev/null; then
+    error "Docker 未安装"
+fi
+
+info "安装到: $INSTALL_DIR"
+
+# 创建目录
+mkdir -p "$INSTALL_DIR"/{resources/{mgt,postgres/data,nginx,detector,chaos,cache,sock,luigi},logs/{nginx,detector},bin,lib}
+
+# 复制二进制 (使用官方完整版)
+cp "$SCRIPT_DIR/webserver_full" "$INSTALL_DIR/bin/webserver"
+cp "$SCRIPT_DIR/tcontrollerd_full" "$INSTALL_DIR/bin/tcontrollerd"
+cp "$SCRIPT_DIR/nginx" "$INSTALL_DIR/bin/nginx"
+chmod +x "$INSTALL_DIR/bin/webserver" "$INSTALL_DIR/bin/tcontrollerd" "$INSTALL_DIR/bin/nginx"
+
+# 复制 musl libc
+cp "$SCRIPT_DIR/ld-musl-x86_64.so.1" "$INSTALL_DIR/lib/"
+
+# 复制 FVM 动态库
+if [ -f "$SCRIPT_DIR/libfvm.so" ]; then
+    cp "$SCRIPT_DIR/libfvm.so" "$INSTALL_DIR/lib/"
+    info "FVM 库已复制"
+fi
+
+info "二进制已复制 (完整版 - 包含 FVM WAF 功能)"
+
+# 生成配置
+if [ ! -f "$INSTALL_DIR/.env" ]; then
+    POSTGRES_PASSWORD=$(tr -dc 'a-zA-Z0-9' < /dev/urandom | head -c 20)
+    cat > "$INSTALL_DIR/.env" << EOF
+SAFELINE_DIR=$INSTALL_DIR
+POSTGRES_PASSWORD=$POSTGRES_PASSWORD
+MGT_PORT=9443
+RELEASE=
+CHANNEL=
+REGION=
+IMAGE_PREFIX=chaitin
+IMAGE_TAG=9.3.9
+SUBNET_PREFIX=192.168.90
+ARCH_SUFFIX=
+EOF
+    info ".env 已生成"
+fi
+
+# 复制 compose
+if [ -f "$SCRIPT_DIR/compose.yaml" ]; then
+    cp "$SCRIPT_DIR/compose.yaml" "$INSTALL_DIR/docker-compose.yaml"
+    info "compose.yaml 已复制"
+fi
+
+info "安装完成!"
+info ""
+info "启动方式:"
+info "  cd $INSTALL_DIR"
+info "  docker compose up -d"
+info ""
+info "管理面板: https://$(hostname -I | awk '{print $1}'):9443/"
+info "获取密码: docker exec safeline-mgt /app/mgt-cli reset-admin --once"
diff --git a/build/ld-musl-x86_64.so.1 b/build/ld-musl-x86_64.so.1
new file mode 100644
index 0000000..5ed7db5
Binary files /dev/null and b/build/ld-musl-x86_64.so.1 differ
diff --git a/build/libfvm.so b/build/libfvm.so
new file mode 100644
index 0000000..354e742
Binary files /dev/null and b/build/libfvm.so differ
diff --git a/build/nginx b/build/nginx
new file mode 100644
index 0000000..1beaae9
Binary files /dev/null and b/build/nginx differ
diff --git a/build/tcontrollerd_full b/build/tcontrollerd_full
new file mode 100644
index 0000000..778f8c5
Binary files /dev/null and b/build/tcontrollerd_full differ
diff --git a/build/webserver_full b/build/webserver_full
new file mode 100644
index 0000000..9edfde3
Binary files /dev/null and b/build/webserver_full differ
diff --git a/submodule/fvm/include/fvm-c/compiler.h b/submodule/fvm/include/fvm-c/compiler.h
index 7e735e1..e0ea790 100644
--- a/submodule/fvm/include/fvm-c/compiler.h
+++ b/submodule/fvm/include/fvm-c/compiler.h
@@ -3,9 +3,13 @@
 
 #include <stddef.h>
 #include <stdbool.h>
+#include <fvm-c/update.h>
 
 typedef struct fvm_compiler fvm_compiler_t;
-typedef struct fvm_output fvm_output_t;
+
+typedef struct {
+    fvm_buf_t buf;
+} fvm_output_t;
 
 fvm_compiler_t *fvm_compiler_acquire(const char *api_table);
 void fvm_compiler_release(fvm_compiler_t *compiler);
@@ -14,6 +18,9 @@ bool fvm_compiler_load_re(fvm_compiler_t *compiler, const char *re, size_t re_le
 bool fvm_compiler_dump_re(fvm_compiler_t *compiler, char **out, size_t *out_len);
 
 fvm_output_t *fvm_compile(fvm_compiler_t *compiler, const char *text);
+fvm_output_t *fvm_serialize(fvm_output_t *output, bool diff, long base, long target);
 void fvm_output_destroy(fvm_output_t *output);
 
+fvm_update_t *fvm_dump(fvm_framework_t *fw);
+
 #endif
diff --git a/submodule/fvm/include/fvm-c/framework.h b/submodule/fvm/include/fvm-c/framework.h
index 928c6ea..3dbaeaa 100644
--- a/submodule/fvm/include/fvm-c/framework.h
+++ b/submodule/fvm/include/fvm-c/framework.h
@@ -1,11 +1,13 @@
 #ifndef FVM_FRAMEWORK_H
 #define FVM_FRAMEWORK_H
 
-#include <ct/string.h>
+#include <stdbool.h>
 
 typedef struct fvm_framework fvm_framework_t;
 
+const char *fvm_api_table(void);
 fvm_framework_t *fvm_framework_acquire(void *config);
 void fvm_framework_release(fvm_framework_t *fw);
+bool fvm_update(fvm_framework_t *fw, fvm_update_t *update);
 
 #endif
diff --git a/submodule/fvm/include/fvm-c/plot.h b/submodule/fvm/include/fvm-c/plot.h
index 9fd9928..171d0a1 100644
--- a/submodule/fvm/include/fvm-c/plot.h
+++ b/submodule/fvm/include/fvm-c/plot.h
@@ -1,10 +1,10 @@
 #ifndef FVM_PLOT_H
 #define FVM_PLOT_H
 
-#include <ct/string.h>
+#include <fvm-c/update.h>
 
 typedef struct {
-    ct_string_t buf;
+    fvm_buf_t buf;
 } fvm_plot_t;
 
 fvm_plot_t *fvm_plot(fvm_framework_t *fw);
diff --git a/submodule/fvm/include/fvm-c/update.h b/submodule/fvm/include/fvm-c/update.h
index f94bcf8..3fc042c 100644
--- a/submodule/fvm/include/fvm-c/update.h
+++ b/submodule/fvm/include/fvm-c/update.h
@@ -1,10 +1,16 @@
 #ifndef FVM_UPDATE_H
 #define FVM_UPDATE_H
 
+#include <stddef.h>
 #include <ct/string.h>
 
 typedef struct {
-    ct_string_t buf;
+    const char *ptr;
+    size_t length;
+} fvm_buf_t;
+
+typedef struct {
+    fvm_buf_t buf;
 } fvm_update_t;
 
 fvm_update_t *fvm_update_create(ct_string_t data);
diff --git a/submodule/fvm/lib/libfvm.so b/submodule/fvm/lib/libfvm.so
new file mode 100644
index 0000000..354e742
Binary files /dev/null and b/submodule/fvm/lib/libfvm.so differ