diff --git a/electron/services/wcdbCore.ts b/electron/services/wcdbCore.ts
index 03bf4f4..5bb6b47 100644
--- a/electron/services/wcdbCore.ts
+++ b/electron/services/wcdbCore.ts
@@ -312,6 +312,8 @@ export class WcdbCore {
       case -2208: return '安全校验失败：目标文件哈希读取失败（-2208）'
       case -2209: return '安全校验失败：目标文件哈希不匹配（-2209）'
       case -2210: return '安全校验失败：签名无效（-2210）'
+      case -2211: return '安全校验失败：主程序 EXE 哈希不匹配（-2211）'
+      case -2212: return '安全校验失败：wcdb_api 模块哈希不匹配（-2212）'
       default: return `安全校验失败（错误码: ${code}）`
     }
   }
@@ -655,6 +657,12 @@ export class WcdbCore {
 
         let protectionOk = false
         let protectionCode = -1
+        let bestFailCode: number | null = null
+        const scoreFailCode = (code: number): number => {
+          if (code >= -2212 && code <= -2201) return 0 // manifest/signature/hash failures
+          if (code === -102 || code === -101 || code === -1006) return 1
+          return 2
+        }
         for (const resPath of resourcePaths) {
           try {
             protectionCode = Number(this.wcdbInitProtection(resPath))
@@ -662,6 +670,9 @@ export class WcdbCore {
               protectionOk = true
               break
             }
+            if (bestFailCode === null || scoreFailCode(protectionCode) < scoreFailCode(bestFailCode)) {
+              bestFailCode = protectionCode
+            }
             this.writeLog(`[bootstrap] InitProtection rc=${protectionCode} path=${resPath}`, true)
           } catch (e) {
             this.writeLog(`[bootstrap] InitProtection exception path=${resPath}: ${String(e)}`, true)
@@ -669,8 +680,9 @@ export class WcdbCore {
         }
 
         if (!protectionOk) {
-          lastDllInitError = this.formatInitProtectionError(protectionCode)
-          this.writeLog(`[bootstrap] InitProtection failed finalCode=${protectionCode}`, true)
+          const finalCode = bestFailCode ?? protectionCode
+          lastDllInitError = this.formatInitProtectionError(finalCode)
+          this.writeLog(`[bootstrap] InitProtection failed finalCode=${finalCode}`, true)
           return false
         }
       } catch (e) {
diff --git a/package.json b/package.json
index 1036279..22177f8 100644
--- a/package.json
+++ b/package.json
@@ -64,6 +64,7 @@
   "build": {
     "appId": "com.WeFlow.app",
     "afterPack": "scripts/afterPack-sign-manifest.cjs",
+    "afterSign": "scripts/afterPack-sign-manifest.cjs",
     "publish": {
       "provider": "github",
       "owner": "hicccc77",
diff --git a/resources/wcdb_api.dll b/resources/wcdb_api.dll
index 8159ef8..750a656 100644
Binary files a/resources/wcdb_api.dll and b/resources/wcdb_api.dll differ
diff --git a/scripts/afterPack-sign-manifest.cjs b/scripts/afterPack-sign-manifest.cjs
index 7e92d50..5b0b6ea 100644
--- a/scripts/afterPack-sign-manifest.cjs
+++ b/scripts/afterPack-sign-manifest.cjs
@@ -245,5 +245,7 @@ module.exports = async function afterPack(context) {
   console.log(`[wf-sign] manifest: ${manifestPath}`);
   console.log(`[wf-sign] signature: ${signaturePath}`);
   console.log(`[wf-sign] exe: ${manifest.targets[0].path}`);
+  console.log(`[wf-sign] exe.sha256: ${manifest.targets[0].sha256}`);
   console.log(`[wf-sign] module: ${manifest.targets[1].path}`);
+  console.log(`[wf-sign] module.sha256: ${manifest.targets[1].sha256}`);
 };